Senior Adversary Emulation Engineer

Make your mark at Comcast -- a Fortune 30 global media and technology company. From the connectivity and platforms we provide, to the content and experiences we create, we reach hundreds of millions of customers, viewers, and guests worldwide. Become part of our award-winning technology team that turns big ideas into cutting-edge products, platforms, and solutions that our customers love. We create space to innovate, and we recognize, reward, and invest in your ideas, while ensuring you can proudly bring your authentic self to the workplace. Join us. You’ll do the best work of your career right here at Comcast. (In most cases, Comcast prefers to have employees on-site collaborating unless the team has been designated as virtual due to the nature of their work. If a position is listed with both office locations and virtual offerings, Comcast may be willing to consider candidates who live greater than 100 miles from the office for the remote option.) Job Summary Comcast Cybersecurity protects Comcast, our customers, our workforce, our partners, and our technology platforms from increasingly sophisticated cyber threats. We are seeking a Senior Adversary Emulation Engineer to help establish and mature adversary emulation as a repeatable capability within Threat Detection. This role sits at the intersection of adversary emulation, threat detection engineering, threat hunting, telemetry validation, and purple team operations. The successful candidate will design and execute controlled, threat-informed emulation scenarios; validate detection coverage across enterprise telemetry sources; generate high-fidelity data for threat hunting; and translate findings into improved detections, hunt content, logging requirements, automations, and actionable reporting. This is a hands-on senior engineering role for someone who can operate safely in complex enterprise environments, partner across cyber and engineering teams, and help Comcast continuously prove and improve its ability to detect real-world adversary behavior.

Core Responsibilities Help establish and mature Comcast’s adversary emulation capability, including operating model, rules of engagement, approval workflows, success metrics, reporting standards, and repeatable validation processes. Design, plan, and execute controlled adversary emulation scenarios based on current threat intelligence, priority adversary behaviors, emerging attack techniques, and Comcast-relevant risk scenarios. Emulate real-world attacker tactics, techniques, and procedures using frameworks such as MITRE ATT&CK, while maintaining strict safety, deconfliction, and operational controls. Build automation and AI-assisted workflows to streamline emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking, with appropriate human review, auditability, and governance. Partner with Threat Detection Engineering to validate detection coverage, alert fidelity, enrichment quality, triage workflows, and detection lifecycle effectiveness. Partner with Threat Hunting to generate high-fidelity telemetry, validate hunt hypotheses, and convert emulation outcomes into reusable hunt content. Identify and document logging gaps, telemetry quality issues, detection blind spots, enrichment deficiencies, and control weaknesses across endpoint, identity, cloud, network, email, SaaS, application, and data-platform sources. Develop repeatable emulation playbooks, test cases, validation workflows, and reporting artifacts that can be reused across priority threats and enterprise environments. Evaluate adversary emulation, breach-and-attack simulation, security validation, and emerging AI-enabled security technologies for use within Comcast’s threat operations environment. Support purple team exercises, threat-informed defense initiatives, after-action reviews, and continuous improvement efforts across cyber operations. Produce clear technical reports and