Senior Adversary Emulation Engineer (Threat Detection)

Comcast; Philadelphia (Philadelphia County); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Comcast is seeking a Senior Adversary Emulation Engineer to lead repeatable emulation across enterprise environments and to mature its threat-informed defense program. You will design attack simulations, validate detection coverage, and partner with multiple cybersecurity and engineering teams to produce measurable improvements.

The role emphasizes safe, governed testing, strong automation, and translating emulation outcomes into production detections and hunt content.

Qualifications

• Bachelor’s degree or equivalent in cybersecurity, CS, IT, engineering, or related field.
• 7+ years in cybersecurity including hands-on adversary emulation, red/purple teaming, detection engineering, or threat hunting.
• Experience with SIEM/XDR/EDR, cloud/log telemetry, and incident response workflows.

Responsibilities

• Design and execute controlled adversary emulation scenarios using MITRE ATT&CK frameworks.
• Validate detection coverage, telemetry quality, and enrichment across enterprise sources.
• Develop reusable playbooks, tests, and reporting artifacts for threat emulation and defense improvements.
• Collaborate with Threat Detection Engineering, Threat Hunting, and Security Engineering teams to translate findings into detections and runbooks.
• Produce clear technical and executive reports with prioritized remediation actions.

Skills

Adversary emulation

Purple teaming

Threat hunting

Automation scripting

Python

Security engineering

Incident response

AI-assisted security workflows

Education

Bachelor’s degree in cybersecurity/CS/IT/engineering

Tools

Atomic Red Team

MITRE Caldera

Mandiant Security Validation

Cymulate

AttackIQ

Prelude Operator

Job description

Comcast is seeking a Senior Adversary Emulation Engineer to lead repeatable emulation across enterprise environments and to mature its threat-informed defense program. You will design attack simulations, validate detection coverage, and partner with multiple cybersecurity and engineering teams to produce measurable improvements.

The role emphasizes safe, governed testing, strong automation, and translating emulation outcomes into production detections and hunt content.