Comcast

Comcast

Principal Adversary Emulation Engineer

PA - Philadelphia, 1800 Arch St · Principal

Sponsorship not specifiedDetected 74 days ago
PythonPowerShellSQLCI/CDCybersecurityPenetration TestingSIEMKQLSOC OperationsDetection EngineeringIncident ResponseCommunicationCISSP

Stay score

odds of building a lasting career here

36Risky
Cap-exempt (no lottery)0
Sponsors this role75
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • Help establish and mature Comcast's adversary emulation capability, including operating model, rules of engagement, approval workflows, success metrics, reporting standards, and repeatable validation processes.
  • Emulate real-world attacker tactics, techniques, and procedures using frameworks such as MITRE ATT&CK, while maintaining strict safety, deconfliction, and operational controls.
  • Evaluate adversary emulation, breach-and-attack simulation, security validation, and emerging AI-enabled security technologies for use within Comcast's threat operations environment.

Responsibilities

  • Design, plan, and execute controlled adversary emulation scenarios based on current threat intelligence, priority adversary behaviors, emerging attack techniques, and Comcast-relevant risk scenarios.
  • Build automation and AI-assisted workflows to streamline emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking, with appropriate human review, auditability, and governance.
  • Partner with Threat Hunting to generate high-fidelity telemetry, validate hunt hypotheses, and convert emulation outcomes into reusable hunt content.
  • Develop repeatable emulation playbooks, test cases, validation workflows, and reporting artifacts that can be reused across priority threats and enterprise environments.
  • Support purple team exercises, threat-informed defense initiatives, after-action reviews, and continuous improvement efforts across cyber operations.

Requirements

  • Bachelor's degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field.
  • 7+ years of relevant cybersecurity experience, including hands-on experience in adversary emulation, red teaming, purple teaming, detection engineering, threat hunting, incident response, or security operations.
  • Strong understanding of adversary tradecraft, attacker lifecycle, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise security telemetry.
  • Experience safely planning and executing controlled security testing in large or complex enterprise environments, including rules of engagement, approvals, deconfliction, and evidence handling.
  • Proficiency with scripting or automation using Python and at least one additional language or shell such as PowerShell or Bash.
  • Experience applying AI-assisted workflows or agentic automation to cybersecurity use cases with appropriate safety, review, and governance controls.
  • Experience working with SIEM, XDR, EDR, endpoint telemetry, identity logs, cloud logs, network data, email security telemetry, and/or application security telemetry.
  • Strong analytical, documentation, and communication skills, including the ability to explain technical findings, detection gaps, and risk implications to technical and non-technical stakeholders.

Nice to have

  • Experience with adversary emulation and validation tools such as Atomic Red Team, MITRE Caldera, Mandiant Security Validation, Cymulate, AttackIQ, Prelude Operator, or similar platforms.
  • Experience with cloud, SaaS, identity, container, CI/CD, endpoint, network, or large-scale data-platform security testing.
  • Relevant certifications such as GCIH, GCIA, GPEN, GXPN, GREM, GCFA, OSCP, OSEP, CRTO, CISSP, or equivalent experience.
  • What Success Looks Like
  • Comcast has a repeatable adversary emulation operating model with clear rules of engagement, test plans, approval workflows, metrics, and reporting.
  • Priority threat scenarios are translated into safe, repeatable emulation exercises mapped to MITRE ATT&CK and Comcast-relevant risk areas.
  • Threat Hunting receives high-quality telemetry and validated hypotheses that improve hunt effectiveness.
  • Logging gaps, blind spots, and data quality issues are documented, prioritized, and converted into actionable remediation work.

Skills

  • Please visit the benefits summary on our careers site for more details.
  • Education
  • Bachelor's Degree
  • Certifications (if applicable)
  • Relevant Work Experience
  • 10 Years +
  • Comcast is an equal opportunity workplace.

Benefits

  • Partner with Threat Detection Engineering to validate detection coverage, alert fidelity, enrichment quality, triage workflows, and detection lifecycle effectiveness.

Company info

  • Become part of our award-winning technology team that turns big ideas into cutting-edge products, platforms, and solutions that our customers love.
  • We are seeking a Senior Adversary Emulation Engineer to help establish and mature adversary emulation as a repeatable capability within Threat Detection.
  • Comcast Cybersecurity protects Comcast, our customers, our workforce, our partners, and our technology platforms from increasingly sophisticated cyber threats.
Apply directly at Comcast →Create a free account for alerts like thisView Comcast immigration profile

This listing is sourced directly from Comcast's careers page and normalized into a canonical job model.