Principal Adversary Emulation Engineer

What you'll do

• Design and safely execute controlled emulation scenarios based on threat intelligence and adversary behaviors.
• Validate detection coverage and telemetry, and translate findings into detection and hunting improvements, logging needs, automation, and reports.
• Develop operating standards, playbooks, workflows, metrics, and AI-assisted processes; support purple team exercises and cross-team improvements.

What they ask for

• 7+ years of relevant cybersecurity experience, including hands-on work in adversary emulation, red/purple teaming, detection engineering, threat hunting, incident response, or security operations.
• Strong understanding of adversary tradecraft, MITRE ATT&CK, threat-informed defense, detection engineering, and enterprise telemetry; experience planning controlled security testing in complex environments.
• Proficiency with Python and at least one additional language or shell, such as PowerShell or Bash; experience applying AI-assisted workflows or agentic automation to cybersecurity with safety and governance controls.
• Experience with security telemetry and SIEM/XDR/EDR, and ability to write or validate detection or hunting logic using formats such as SPL, KQL, SQL, Sigma, or YARA.

Nice to have

• Experience building or maturing adversary emulation, purple team, or detection validation functions; familiarity with tools such as Atomic Red Team, MITRE Caldera, or AttackIQ.
• Experience converting emulation results into production detections, hunt content, logging requirements, or measurable coverage improvements; relevant certifications or equivalent experience.

Tools

MITRE ATT&CK, Python, PowerShell, Bash, SPL, KQL, SQL, Sigma

AI focus

Build automation and AI-assisted workflows for emulation planning, execution, evidence collection, detection validation, reporting, and metrics, with human review, auditability, and governance; evaluate AI-enabled security technologies.