Senior Adversary Emulation Engineer - Threat Detection

Comcast; Philadelphia (Philadelphia County); On-site; USD 134,000 - 211,000; Full time

Job summary

Comcast Cybersecurity is seeking a Senior Adversary Emulation Engineer to establish and mature adversary emulation as a repeatable capability. You will design controlled emulation scenarios, validate detections, and produce high-fidelity telemetry for threat hunting.

This role requires strong collaboration with engineering and security teams and a hands-on approach across complex enterprise environments. The ideal candidate has extensive experience in adversary emulation, detection engineering,

Qualifications

• Bachelor’s degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field.
• 7+ years of relevant cybersecurity experience, including hands-on adversary emulation, red/purple teaming, detection engineering, and threat hunting.
• Strong understanding of MITRE ATT&CK, threat-informed defense, detection engineering, and telemetry.
• Experience safely planning and executing controlled security testing in large or complex enterprise environments.
• Proficiency with scripting or automation using Python and at least one additional language or shell such as PowerShell or Bash.
• Experience applying AI-assisted workflows or agentic automation to cybersecurity use cases with appropriate safety, review, and governance controls.
• Experience working with SIEM, XDR, EDR, endpoint telemetry, identity logs, cloud logs, network data, email security telemetry, and/or application security telemetry.
• Ability to write, review, or validate detection and hunting logic using query languages or formats such as SPL, KQL, SQL, Sigma, YARA, or similar.
• Strong analytical, documentation, and communication skills, including the ability to explain technical findings, detection gaps, and risk implications to technical and non-technical stakeholders.
• Ability to work independently, exercise sound judgment, and collaborate across multiple teams in a fast-moving enterprise security environment.

Responsibilities

• Establish and mature Comcast’s adversary emulation capability with rules of engagement and governance.
• Design, plan, and execute threat-informed emulation scenarios using MITRE ATT&CK.
• Emulate attacker techniques while maintaining safety and deconfliction.
• Develop automation and AI-assisted workflows for planning, evidence collection, test execution, detection validation, and reporting.
• Partner with Threat Detection Engineering to validate detection coverage and telemetry.
• Collaborate with Threat Hunting to generate high-fidelity telemetry and reusable hunt content.
• Identify logging gaps, telemetry quality issues, and data gaps across endpoints, cloud, network, and data platforms.
• Create repeatable emulation playbooks, test cases, validation workflows, and reporting artifacts.
• Evaluate adversary emulation and security validation technologies for use within Comcast’s threat operations.
• Support purple team exercises and after-action reviews to drive improvements.
• Produce clear technical reports and executive-ready summaries translating results into prioritized recommendations.
• Collaborate across Cybersecurity, Security Operations, Threat Intelligence, Cloud, Identity, Endpoint, Network, and Product teams.

Skills

Adversary emulation

Red teaming

Purple teaming

Detection engineering

Threat hunting

Incident response

Security operations

Python scripting

AI-assisted workflows

Threat intelligence

Education

Bachelor’s degree

Job description

Comcast Cybersecurity is seeking a Senior Adversary Emulation Engineer to establish and mature adversary emulation as a repeatable capability. You will design controlled emulation scenarios, validate detections, and produce high-fidelity telemetry for threat hunting.

This role requires strong collaboration with engineering and security teams and a hands-on approach across complex enterprise environments. The ideal candidate has extensive experience in adversary emulation, detection engineering,