Principal Adversary Emulation Engineer

Comcast • Philadelphia, PA

3d

About The Position

Comcast Cybersecurity is seeking a senior engineer to establish and mature adversary emulation as a repeatable capability within Threat Detection. The role sits at the intersection of adversary emulation, threat detection engineering, threat hunting, telemetry validation, and purple team operations. The engineer will design and execute controlled, threat-informed scenarios; validate detection coverage across enterprise telemetry; generate high-fidelity data for threat hunting; and translate findings into improved detections, hunt content, logging requirements, automations, and actionable reporting. This is a hands-on senior engineering position requiring safe operation in complex enterprise environments and collaboration across cybersecurity and engineering teams.

The position will help define Comcast’s adversary emulation operating model, including rules of engagement, approvals, success metrics, reporting, and repeatable validation processes. It will apply current threat intelligence and frameworks such as MITRE ATT&CK to emulate relevant attacker behaviors, while maintaining safety, deconfliction, and operational controls. The engineer will build automation and AI-assisted workflows with appropriate human review, auditability, and governance; partner with Detection Engineering and Threat Hunting; identify telemetry and control gaps; develop reusable playbooks and test cases; assess security validation technologies; and support purple team and threat-informed defense initiatives.

The role also produces technical reports and executive-ready summaries that translate results into prioritized recommendations, measurable detection improvements, and risk-informed remediation actions. Comcast notes that it generally prefers employees to work on-site unless a team has been designated virtual. Where both office locations and virtual options are listed, candidates living more than 100 miles from the office may be considered for the remote option; no specific workplace arrangement is stated for this role.

Requirements

• Bachelor’s degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field.
• At least 7 years of relevant cybersecurity experience, including hands-on experience in adversary emulation, red teaming, purple teaming, detection engineering, threat hunting, incident response, or security operations.
• Strong understanding of adversary tradecraft, attacker lifecycle, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise security telemetry.
• Experience safely planning and executing controlled security testing in large or complex enterprise environments, including rules of engagement, approvals, deconfliction, and evidence handling.
• Proficiency in Python and at least one additional scripting or automation language or shell, such as PowerShell or Bash.
• Experience applying AI-assisted workflows or agentic automation to cybersecurity use cases with appropriate safety, review, and governance controls.
• Experience working with SIEM, XDR, EDR, endpoint telemetry, identity logs, cloud logs, network data, email security telemetry, and/or application security telemetry.
• Ability to write, review, or validate detection and hunting logic using query languages or formats such as SPL, KQL, SQL, Sigma, YARA, or similar.
• Strong analytical, documentation, and communication skills, including the ability to explain technical findings, detection gaps, and risk implications to technical and non-technical stakeholders.
• Ability to work independently, exercise sound judgment, and collaborate across multiple teams in a fast-moving enterprise security environment.

Nice To Haves

• Experience helping build or mature an adversary emulation, purple team, detection validation, or security validation function.
• Experience with adversary emulation and validation tools such as Atomic Red Team, MITRE Caldera, Mandiant Security Validation, Cymulate, AttackIQ, Prelude Operator, or similar platforms.
• Experience converting emulation results into production detections, hunt content, logging requirements, dashboards, runbooks, and measurable detection coverage improvements.
• Experience with cloud, SaaS, identity, container, CI/CD, endpoint, network, or large-scale data-platform security testing.
• Relevant certifications such as GCIH, GCIA, GPEN, GXPN, GREM, GCFA, OSCP, OSEP, CRTO, CISSP, or equivalent experience.

Responsibilities

• Help establish and mature the adversary emulation capability, including its operating model, rules of engagement, approval workflows, success metrics, reporting standards, and repeatable validation processes.
• Design, plan, and execute controlled emulation scenarios based on current threat intelligence, priority adversary behaviors, emerging attack techniques, and Comcast-relevant risks.
• Emulate real-world attacker tactics, techniques, and procedures using frameworks such as MITRE ATT&CK while maintaining safety, deconfliction, and operational controls.
• Build automation and AI-assisted workflows for emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking, with appropriate human review, auditability, and governance.
• Partner with Threat Detection Engineering to validate detection coverage, alert fidelity, enrichment quality, triage workflows, and detection lifecycle effectiveness.
• Partner with Threat Hunting to generate high-fidelity telemetry, validate hunt hypotheses, and convert outcomes into reusable hunt content.
• Identify and document logging gaps, telemetry quality issues, detection blind spots, enrichment deficiencies, and control weaknesses across endpoint, identity, cloud, network, email, SaaS, application, and data-platform sources.
• Develop reusable emulation playbooks, test cases, validation workflows, and reporting artifacts for priority threats and enterprise environments.
• Evaluate adversary emulation, breach-and-attack simulation, security validation, and emerging AI-enabled security technologies for Comcast’s threat operations environment.
• Support purple team exercises, threat-informed defense initiatives, after-action reviews, and continuous improvement across cyber operations.
• Produce technical reports and executive-ready summaries with prioritized recommendations, measurable detection improvements, and risk-informed remediation actions.
• Collaborate with Cybersecurity, Security Operations, Security Incident Response, Threat Intelligence, Threat Hunting, Detection Engineering, Security Engineering, Cloud, Identity, Endpoint, Network, Product, and other technical teams.

Benefits

• A range of benefit options and expert guidance to support employees physically, financially, and emotionally.
• Always-on tools personalized to employees’ needs.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior