Principal Adversary Emulation Engineer

Salary: $90,000 - 135,000 per year Requirements: Bachelors degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field; applicants with a combination of coursework and experience may also be considered. At least 7 years of relevant cybersecurity experience, including hands-on work in adversary emulation, red or purple teaming, detection engineering, threat hunting, incident response, or security operations. Strong understanding of adversary tradecraft, attacker lifecycles, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise security telemetry. Experience safely planning and conducting controlled security testing in large or complex enterprise environments, including managing rules of engagement, approvals, deconfliction, and evidence. Proficiency in Python and at least one other programming or scripting language, such as PowerShell or Bash. Experience applying AI-assisted workflows or agentic automation to cybersecurity, with suitable safety, review, and governance controls. Experience with SIEM, XDR, EDR, endpoint telemetry, identity and cloud logs, network data, email security telemetry, and/or application security telemetry. Ability to write, review, or validate detection and hunting logic using SPL, KQL, SQL, Sigma, YARA, or similar languages and formats. Strong analytical, documentation, and communication skills, including the ability to explain technical findings and risk to technical and non-technical stakeholders. Ability to work independently, use sound judgment, and collaborate across teams in a fast-moving enterprise security environment. Preferred: Experience establishing or maturing an adversary emulation, purple team, detection validation, or security validation function. Preferred: Familiarity with tools such as Atomic Red Team, MITRE Caldera, Mandiant Security Validation, Cymulate, AttackIQ, or Prelude Operator. Preferred: Experience turning emulation results into production detections, hunt content, logging requirements, dashboards, runbooks, and measurable coverage improvements. Preferred: Security testing experience across cloud, SaaS, identity, containers, CI/CD, endpoints, networks, or large-scale data platforms. Preferred: Relevant certifications such as GCIH, GCIA, GPEN, GXPN, GREM, GCFA, OSCP, OSEP, CRTO, or CISSP, or equivalent experience. Responsibilities: Establish and mature our adversary emulation capability, including its operating model, rules of engagement, approval workflows, success measures, reporting standards, and repeatable validation processes. Design and conduct controlled emulation scenarios informed by current threat intelligence, priority adversary behaviors, emerging techniques, and risks relevant to Comcast. Reproduce real-world attacker tactics, techniques, and procedures using frameworks such as MITRE ATT&CK, while maintaining strict safety, deconfliction, and operational controls. Develop automation and AI-assisted workflows for emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking, with appropriate human review, auditability, and governance. Work with Threat Detection Engineering to assess detection coverage, alert fidelity, enrichment, triage workflows, and detection lifecycle effectiveness. Partner with Threat Hunting to generate high-quality telemetry, test hunt hypotheses, and turn results into reusable hunt content. Identify and document logging gaps, telemetry quality issues, detection blind spots, enrichment deficiencies, and control weaknesses across endpoint, identity, cloud, network, email, SaaS, application, and data-platform sources. Create reusable emulation playbooks, test cases, validation workflows, and reporting materials for priority threats and enterprise environments. Assess adversary emulation, breach-and-attack simulation, security validation, and emerging AI-enabled security technologies for potential use in our threat operations. Support purple team exercises, threat-informed defense initiatives, after-action reviews, and continuous improvement across cyber operations. Prepare technical reports and executive summaries that turn findings into prioritized recommendations, measurable detection improvements, and risk-informed remediation actions. Collaborate with Cybersecurity, Security Operations, Incident Response, Threat Intelligence, Threat Hunting, Detection Engineering, Security Engineering, Cloud, Identity, Endpoint, Network, Product, and other technical teams. Technologies: AI Bash CI/CD Cloud Support Network PowerShell Python SQL Security DevOps More: We are Comcast, a Fortune 30 global media and technology company whose connectivity, platforms, content, and experiences reach customers, viewers, and guests worldwide. Through hackajob, we are connecting with professionals for this Senior Adversary Emulation Engineer role in our Cybersecurity organization, which protects our company, customers, workforce, partners, and technology platforms from evolving cyber threats. This hands-on senior role sits across adversary emulation, threat detection engineering, threat hunting, telemetry validation, and purple team operations. We aim to build a trusted, repeatable capability that helps improve our readiness against real-world threats. Our award-winning technology teams have room to innovate, and we recognize, reward, and invest in employee ideas while supporting people in bringing their authentic selves to work. We generally favor on-site collaboration unless a team is designated as virtual; remote arrangements may be considered for some roles and locations. We are an equal opportunity employer and provide eligible employees with total rewards, including bonus eligibility for most non-sales roles and a broad benefits offering designed to support physical, financial, and emotional well-being. last updated 42 week of 2026