Purple Teaming Engineer - Embedded Security

Lucid Motors; Riyadh; On-site; SAR 200,000 - 250,000; Full time

Job summary

A leading automotive technology company located in the Riyadh Region is seeking a Purple Teaming Engineer with hands-on experience in offensive and defensive security, particularly in embedded systems. Responsibilities include operationalizing Purple Team simulations, collaborating with Red and SOC teams, and executing adversary simulation plans. The ideal candidate will possess a Bachelor's degree in a related field and 5+ years of experience in Red Teaming or SOC operations. Expertise in programming and SIEM systems is preferred.

Qualifications

• At least 5 years of professional experience.
• 3–6 years of combined experience in Red Teaming, SOC, detection engineering, or embedded security testing.
• Strong knowledge of MITRE ATT&CK.
• Experience working with embedded Linux, Android systems, RTOS, or MCU platforms.

Responsibilities

• Operationalize Purple Team and Attack Simulation exercises.
• Develop and execute adversary simulation plans.
• Collaborate with Red and Blue teams to identify detection gaps.
• Support offensive testing across RTOS, Linux, Android, and MCU-based systems.
• Draft and present technical reports of Purple Team activities.

Skills

Red Teaming

SOC operations

Detection engineering

Embedded systems

Scripting/automation using Python

Threat simulation tools

Log analysis

Network security

Education

Bachelor's Degree in Cybersecurity, Information Security, Computer Science, or Information Technology

Tools

SIEM systems (e.g., Splunk, ELK)

Burp Suite

Ghidra

Binwalk

Job description

Job Summary

We are seeking a Purple Teaming Engineer with hands‑on experience in both offensive and defensive security, with a focus on embedded systems.

The ideal candidate will have practical experience with SOC operations, adversary simulation, detection engineering, and security testing across embedded or cloud‑connected systems.

You will play a key role in executing threat emulation, automating adversary TTPs, and enhancing detection capabilities in collaboration with Red and SOC team.

Experience with vehicle SOC and security operations is a plus.

Key Responsibilities

• Operationalize Purple Team and Attack Simulation exercises across embedded and cloud‑connected systems.
• Develop and execute adversary simulation plans that align with threat intelligence.
• Collaborate with Red and Blue teams to identify detection gaps and improve SOC effectiveness.
• Identify relevant log sources across assets, ECUs, and infrastructure; document the type, location, and format of logs required for effective cybersecurity anomaly detection.
• Regularly review the availability, completeness, and integrity of logs; highlight gaps and work with asset/ECU owners to ensure alignment with best security logging practices.
• Share recommendations with system and asset owners on required logging improvements, event visibility, and adherence to secure logging practices.
• Support offensive testing across RTOS, Linux, Android, and MCU‑based systems.
• Draft and present technical reports and summaries of Purple Team activities to technical and management stakeholders.
• Communicate findings, detecting weaknesses, meeting the logging requirements and prioritized remediation strategies.

Collaborative Objectives

• Work closely with SOC & Red teams to convert threat intel into actionable TTPs and test cases.
• Support SOC operations and help validate detection logic with real‑world simulations.
• Assist in control validation, SIEM optimization, and threat modeling automation.
• Provide mentorship to junior team members on simulation workflows and embedded systems.
• Contribute to the ongoing development of the team’s offensive and defensive testing capabilities.

Required Qualifications

• Bachelor's Degree in Cybersecurity, Information Security, Computer Science, or Information Technology and at least 5 years of professional experience.
• 3–6 years of combined experience in Red Teaming, SOC, detection engineering, or embedded security testing.
• Strong knowledge of MITRE ATT&CK, threat simulation tools, and detection principles.
• Experience working with embedded Linux, Android systems, RTOS, or MCU platforms.
• Familiarity with SIEM systems (e.g., Splunk, ELK), log analysis.
• Proficiency in scripting/automation using Python.
• Exposure to network security, including packet analysis and custom protocol fuzzing.
• Exposure with vehicle communications (CAN, UDS, DoIP, BLE, MQTT, etc.).
• Strong technical writing and communication skills for documentation and stakeholder engagement.

Preferred Qualifications

• Experience in vehicle cybersecurity/SOC or embedded threat detection.
• Familiar with tools like Burp Suite, Ghidra, Binwalk, or custom fuzzers.
• Experience simulating or detecting low-level attacks, including firmware tampering, memory corruption, and secure boot bypasses.
• Understanding of cloud security architecture related to embedded platforms.
• Working knowledge of SIEM solutions, telemetry pipelines, and threat hunting frameworks.