Threat Emulation Engineer IV

Team Overview

A Threat Emulation Engineer is an introductory role to Red Teams focused on developing foundational skills in adversary tradecraft replication and assessment execution. Engineers at this level work within clearly defined scope and are supported through structured review, feedback, and mentorship. The role is designed as an entry point into Threat Emulation for individuals with experience in related technical fields. No prior Red Team or offensive security experience is required.

• The primary focus of the position is Threat Detection Assessments (TDAs). These are collaborative engagements where the team tests whether the organization's defenses can identify specific adversary techniques. Engineers research how adversaries carry out specific techniques, then build and run tests that replicate those techniques in a controlled environment. They document what they built, how they ran it, and what the organization's defenses did in response.
• Day‑to‑day work includes reading technical research on adversary techniques, reproducing those techniques in a test environment, writing the tools or scripts needed to run each test, executing tests alongside partner teams, and documenting the results. Engineers own the quality of their work products. All work is reviewed by senior engineers before use, but the author is responsible for iterating and improving based on that feedback.
• Engineers also shadow and support the team's other services under senior guidance. Threat Response Exercises (TRXs) are collaborative engagements where partner teams rehearse incident response. Threat Emulation Operations (TEOs) are unannounced campaigns that test the organization's overall readiness. Exposure to both builds the context needed for advancement.

• Growth at the level is structured around mentorship and increasing independence. Senior engineers define scope, assign work, and provide feedback. Over time, engineers take on broader assignments and work more independently as their skills develop.
• Review is treated as a learning mechanism rather than a gatekeeping process. Senior engineers identify strengths and areas for growth, and build on those strengths while developing in weaker areas. The goal is to develop an adversary mindset, meaning the ability to think about systems from an attacker's perspective and apply that thinking to realistic test scenarios.
• Advancement is based on demonstrated capability, not time in grade. The signals that define readiness include the ability to independently research and replicate adversary techniques, clearly document findings, and represent the team to partner functions with confidence. Performance is measured by growth toward these capabilities rather than output volume.

• The Threat Emulation team works closely with Threat Intelligence, Threat Response, and Threat Detection as part of an integrated threat management model. Engineers interact with these partner teams during assessments and exercises, explaining what they tested and coordinating during execution.
• Engineers are expected to present their work to peers and partner teams, ask questions when concepts are unclear, and respond constructively to feedback. They are not expected to drive cross‑team processes independently. When coordination needs go beyond explanation or learning, engineers are escalated to more experienced team members.

• Formal education in computer science, engineering, information security, or a related technical field may be helpful, but is not required. Equivalent experience gained through professional work, independent study, home lab environments, research projects, or other hands‑on technical learning is equally valued.
• 7 years of experience in security operations, IT, systems administration, software engineering, penetration testing, academic study, self‑directed learning, or other technical backgrounds.
• Operating system fundamentals, such as process execution, authentication, privilege models, and system events.
• Basic networking concepts, including common protocols and client‑server interactions.
• Familiarity with scripting or…