16 days ago
Responsibilities
- Establish and mature Comcast’s adversary emulation operating model, including rules of engagement, approvals, metrics, reporting, and repeatable validation processes.
- Design and execute controlled, threat-informed emulation scenarios mapped to MITRE ATT&CK and relevant enterprise risks.
- Build automation and AI-assisted workflows for emulation planning, evidence collection, test execution, detection validation, reporting, and metrics tracking.
- Partner with threat detection engineering and threat hunting teams to validate coverage, alert fidelity, telemetry, hunt hypotheses, and response workflows.
- Identify logging gaps, telemetry issues, detection blind spots, enrichment deficiencies, and control weaknesses across enterprise data sources.
- Develop reusable emulation playbooks, test cases, validation workflows, reports, and actionable remediation recommendations.
- Support purple team exercises, security validation initiatives, after-action reviews, and continuous cyber defense improvements.
Requirements
- Bachelor’s degree or equivalent experience in cybersecurity, computer science, information technology, engineering, or a related field.
- At least 7 years of relevant cybersecurity experience, including hands-on adversary emulation, red teaming, purple teaming, detection engineering, threat hunting, incident response, or security operations experience.
- Strong understanding of adversary tradecraft, attacker lifecycles, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise security telemetry.
- Experience planning and executing controlled security testing in complex enterprise environments with approvals, deconfliction, rules of engagement, and evidence handling.
- Proficiency with Python and at least one additional language or shell, such as PowerShell or Bash.
- Experience applying AI-assisted workflows or agentic automation to cybersecurity use cases with safety, review, and governance controls.
- Experience with SIEM, XDR, EDR, endpoint telemetry, identity logs, cloud logs, network data, email security telemetry, or application security telemetry.
- Ability to write, review, or validate detection and hunting logic using SPL, KQL, SQL, Sigma, YARA, or similar formats.
- Strong analytical, documentation, communication, judgment, and cross-functional collaboration skills.
- Preferred experience building adversary emulation, purple team, detection validation, or security validation functions; using tools such as Atomic Red Team, MITRE Caldera, Mandiant Security Validation, Cymulate, AttackIQ, or Prelude Operator; and holding relevant cybersecurity certifications.
Benefits
- Comcast provides an array of benefits and personalized support tools for eligible employees, including physical, financial, and emotional wellbeing resources.
- The role is generally expected to be onsite unless the team is designated virtual; positions with virtual offerings may consider candidates located more than 100 miles from the office.
- Comcast offers bonus eligibility for most non-sales positions and provides additional total-rewards benefits, with details available in its compensation and benefits summary.
About Comcast
Comcast is a U.S.-based media and telecommunications company that sells broadband, video, wireless, and voice services to consumers and businesses under the Xfinity and Comcast Business brands. It also owns NBCUniversal (including NBC, Universal Pictures, and Peacock) and Sky, operating TV networks, film studios, and streaming in the U.S. and Europe. Founded in 1963 and headquartered in Philadelphia, it is publicly traded on Nasdaq (CMCSA).