{"id":1957330,"url":"https://alion.io/job/comcast-corporation-principal-adversary-emulation-engineer","title":"Principal Adversary Emulation Engineer","company":{"id":9377,"name":"Comcast","domain":"comcast.com","url":"https://alion.io/company/comcast-corporation","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Philadelphia, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":82000,"max_usd":165000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1829},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Bash","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"CI/CD","optional":true}],"status":"live","first_seen_at":"2026-10-06T13:44:05Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-22T00:47:02Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"Make your mark at Comcast -- a Fortune 30 global media and technology company. From the connectivity and platforms we provide, to the content and experiences we create, we reach hundreds of millions of customers, viewers, and guests worldwide. Become part of our award-winning technology team that turns big ideas into cutting-edge products, platforms, and solutions that our customers love. We create space to innovate, and we recognize, reward, and invest in your ideas, while ensuring you can proudly bring your authentic self to the workplace. Join us. You’ll do the best work of your career right here at Comcast. (In most cases, Comcast prefers to have employees on-site collaborating unless the team has been designated as virtual due to the nature of their work. If a position is listed with both office locations and virtual offerings, Comcast may be willing to consider candidates who live greater than 100 miles from the office for the remote option.)Job Summary\nComcast Cybersecurity protects Comcast, our customers, our workforce, our partners, and our technology platforms from increasingly sophisticated cyber threats. We are seeking a Senior Adversary Emulation Engineer to help establish and mature adversary emulation as a repeatable capability within Threat Detection.This role sits at the intersection of adversary emulation, threat detection engineering, threat hunting, telemetry validation, and purple team operations. The successful candidate will design and execute controlled, threat-informed emulation scenarios; validate detection coverage across enterprise telemetry sources; generate high-fidelity data for threat hunting; and translate findings into improved detections, hunt content, logging requirements, automations, and actionable reporting.\nThis is a hands-on senior engineering role for someone who can operate safely in complex enterprise environments, partner across cyber and engineering teams, and help Comcast continuously prove and improve its ability to detect real-world adversary behavior.\nJob Description\nCore Responsibilities\nHelp establish and mature Comcast’s adversary emulation capability, including operating model, rules of engagement, approval workflows, success metrics, reporting standards, and repeatable validation processes.\n\nDesign, plan, and execute controlled adversary emulation scenarios based on current threat intelligence, priority adversary behaviors, emerging attack techniques, and Comcast-relevant risk scenarios.\n\nEmulate real-world attacker tactics, techniques, and procedures using frameworks such as MITRE ATT&CK, while maintaining strict safety, deconfliction, and operational controls.\n\nBuild automation and AI-assisted workflows to streamline emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking, with appropriate human review, auditability, and governance.\n\nPartner with Threat Detection Engineering to validate detection coverage, alert fidelity, enrichment quality, triage workflows, and detection lifecycle effectiveness.\n\nPartner with Threat Hunting to generate high-fidelity telemetry, validate hunt hypotheses, and convert emulation outcomes into reusable hunt content.\n\nIdentify and document logging gaps, telemetry quality issues, detection blind spots, enrichment deficiencies, and control weaknesses across endpoint, identity, cloud, network, email, SaaS, application, and data-platform sources.\n\nDevelop repeatable emulation playbooks, test cases, validation workflows, and reporting artifacts that can be reused across priority threats and enterprise environments.\n\nEvaluate adversary emulation, breach-and-attack simulation, security validation, and emerging AI-enabled security technologies for use within Comcast’s threat operations environment.\n\nSupport purple team exercises, threat-informed defense initiatives, after-action reviews, and continuous improvement efforts across cyber operations.\n\nProduce clear technical reports and executive-ready summaries that translate emulation results into prioritized recommendations, measurable detection improvements, and risk-informed remediation actions.\n\nCollaborate across Cybersecurity, Security Operations, Security Incident Response, Threat Intelligence, Threat Hunting, Detection Engineering, Security Engineering, Cloud, Identity, Endpoint, Network, Product, and other technical teams.\n\nRequired Qualifications\nBachelor’s degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field.\n\n7+ years of relevant cybersecurity experience, including hands-on experience in adversary emulation, red teaming, purple teaming, detection engineering, threat hunting, incident response, or security operations.\n\nStrong understanding of adversary tradecraft, attacker lifecycle, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise security telemetry.\n\nExperience safely planning and executing controlled security testing in large or complex enterprise environments, including rules of engagement, approvals, deconfliction, and evidence handling.\n\nProficiency with scripting or automation using Python and at least one additional language or shell such as PowerShell or Bash.\n\nExperience applying AI-assisted workflows or agentic automation to cybersecurity use cases with appropriate safety, review, and governance controls.\n\nExperience working with SIEM, XDR, EDR, endpoint telemetry, identity logs, cloud logs, network data, email security telemetry, and/or application security telemetry.\n\nAbility to write, review, or validate detection and hunting logic using query languages or formats such as SPL, KQL, SQL, Sigma, YARA, or similar.\n\nStrong analytical, documentation, and communication skills, including the ability to explain technical findings, detection gaps, and risk implications to technical and non-technical stakeholders.\n\nAbility to work independently, exercise sound judgment, and collaborate across multiple teams in a fast-moving enterprise security environment.\n\nPreferred Qualifications\nExperience helping build or mature an adversary emulation, purple team, detection validation, or security validation function.\n\nExperience with adversary emulation and validation tools such as Atomic Red Team, MITRE Caldera, Mandiant Security Validation, Cymulate, AttackIQ, Prelude Operator, or similar platforms.\n\nExperience turning emulation results into production detections, hunt content, logging requirements, dashboards, runbooks, and measurable detection coverage improvements.\n\nExperience with cloud, SaaS, identity, container, CI/CD, endpoint, network, or large-scale data-platform security testing.\n\nRelevant certifications such as GCIH, GCIA, GPEN, GXPN, GREM, GCFA, OSCP, OSEP, CRTO, CISSP, or equivalent experience.\n\nWhat Success Looks Like\nComcast has a repeatable adversary emulation operating model with clear rules of engagement, test plans, approval workflows, metrics, and reporting.\n\nPriority threat scenarios are translated into safe, repeatable emulation exercises mapped to MITRE ATT&CK and Comcast-relevant risk areas.\n\nDetection Engineering receives clear validation results that improve detection coverage, alert fidelity, enrichment, and response workflows.\n\nThreat Hunting receives high-quality telemetry and validated hypotheses that improve hunt effectiveness.\n\nLogging gaps, blind spots, and data quality issues are documented, prioritized, and converted into actionable remediation work.\n\nEmulation outcomes are consistently converted into detections, hunts, dashboards, reports, and measurable improvements to Comcast’s cyber defense posture.\n\nCross-functional partners view adversary emulation as a trusted, safe, and valuable capability that improves enterprise readiness against real-world threats.\n\nSkills\nArtificial Intelligence Technologies, Cyber Defense, Cyber Threat Intelligence, Incident Response, Penetration Testing, Security Engineering, Security TestingWe believe that benefits should connect you to the support you need when it matters most, and should help you care for those who matter most. That's why we provide an array of options, expert guidance and always-on tools that are personalized to meet the needs of your reality-to help support you physically, financially and emotionally through the big milestones and in your everyday life.\nPlease visit the benefits summary on our careers site for more details.\nEducation\nBachelor's DegreeWhile possessing the stated degree is preferred, Comcast also may consider applicants who hold some combination of coursework and experience, or who have extensive related professional experience.Certifications (if applicable)\nRelevant Work Experience\n10 Years +Comcast is an equal opportunity workplace. We will consider all qualified applicants for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability, veteran status, genetic information, or any other basis protected by applicable law.","description_format":"text","description_chars":9043,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Media & Entertainment","Broadcasting","Broadband","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-06T13:44:05Z"}],"visa":[],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.692,"p_room":0.55,"age_days":14,"expected_fill_days":11,"reasons":["conf:0","velocity","win:tail","comp:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/comcast-corporation-principal-adversary-emulation-engineer","json_url":"https://alion.io/job/comcast-corporation-principal-adversary-emulation-engineer.json","meta":{"generated_at":"2026-10-22T02:27:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1936,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9377},"rest":"https://alion.io/mcp/rest/get_company?id=9377"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcomcast-corporation-principal-adversary-emulation-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcomcast-corporation-principal-adversary-emulation-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcomcast-corporation-principal-adversary-emulation-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/comcast-corporation-principal-adversary-emulation-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcomcast-corporation-principal-adversary-emulation-engineer"}]}