Cyber Simulation Exercises Scenario Developer

The Cyber Simulation Exercises Scenario Developer designs, builds, and delivers large-scale cybersecurity simulation exercises (Threat Hunting Event, Live Fire Exercises, Capture the Flag) to uplift workforce cyber capability. This role develops realistic scenarios on a cyber range platform, creates exercise “injects” and artifacts, and builds/maintains the supporting lab infrastructure to enable repeatable, measurable training at scale.

• Design end-to-end cyber simulation exercises aligned to organizational capability uplift goals (e.g., phishing response, ransomware, cloud misconfigurations, insider threat, incident response coordination).
• Translate learning objectives into engaging storylines, technical objectives, and measurable outcomes.
• Develop multi-track scenarios for different audiences (IT, SOC, incident commanders, and executives) with appropriate complexity and realism.
• Ensure scenarios reflect current threat landscape and common enterprise environments (Windows/Linux, AD, email, web applications, cloud, endpoints).

• Produce complete exercise packages including: facilitator guides, participant instructions, runbooks, timelines, scoring rubrics, and debrief materials.
• Create realistic artifacts: emails, chat transcripts, tickets, logs, alerts, threat intel snippets, media statements, executive briefings, and policy references.
• Build assessment content (pre/post checks, knowledge validations, performance-based evaluation criteria).
• Create and manage exercise injects (technical and non-technical) to drive decision-making and actions during the simulation.
• Implement inject delivery mechanisms within the cyber range (automated triggers, timed releases, event-driven injects).
• Coordinate inject timing, escalation paths, and branching logic based on participant actions.

• Build and configure lab environments required for scenarios (networks, endpoints, servers, identity services, security tooling).
• Integrate common security tools and telemetry sources (SIEM, EDR, IDS, email security, vulnerability scanners) as required by the exercise.

• Support dry runs, pilot sessions, and production execution; troubleshoot technical issues during live exercises.
• Provide facilitators with clear runbooks, decision points, and expected participant actions.
• Capture exercise telemetry and participant performance data for reporting and continuous improvement.

• Define KPIs and scoring models (time-to-detect, time-to-contain, decision quality, process adherence, communication effectiveness).
• Produce post-exercise reports and lessons learned; recommend improvements to content, controls, and processes.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience.
• Proven experience developing cybersecurity simulation exercises on a cyber range platform (hands‑on).
• Demonstrated ability to create injects and exercise artifacts that drive realistic participant behavior.
• Experience building and operating lab infrastructure (virtualized or cloud‑based) for cyber scenarios.
• Strong understanding of incident response lifecycle, common attack techniques, and defensive controls.

• Cyber range platforms: hands‑on experience with at least one commercial or open cyber range solution (platform‑agnostic, but must have real implementation experience).
• Infrastructure: virtualization and networking fundamentals (segmentation, routing, DNS, AD basics).
• Automation/scripting:
  Power Shell, Python, Bash (at least one strong).
• Logging/monitoring concepts: SIEM/EDR telemetry, log sources, alerting logic.