Cybersecurity Adversarial Validation Engineer

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of GovTech, is a cybersecurity assurance service provider whose Adversarial Validation team emulates real adversaries end to end and works with defenders to turn findings into durable detection and response. The Adversarial Validation Engineer plans and executes adversary emulation and purple team engagements, and translates them into high-fidelity detection logic in the customer's SIEM and detection stack.

Key responsibilities

• Plan and run adversary emulation engagements mapped to MITRE ATT&CK, aligned to realistic threat actors, and run purple team exercises in a controlled way, observing telemetry and iterating with customer defenders.
• Validate preventive, detective and response controls against emulated TTPs and document evidence, timelines and outcomes for technical and executive audiences.
• Convert emulation results into detection gaps, hypotheses and coverage maps, and author, tune and validate detection rules in SIEM/detection platforms such as Splunk, Microsoft Sentinel/Defender, Elastic, Chronicle, CrowdStrike and SentinelOne.
• Build high-fidelity detections that balance true positives against alert fatigue, create detection-as-code artifacts (Sigma rules, unit tests, ATT&CK coverage heat maps) and collaborate with SOC teams on deployment and iteration.
• Support scoping, rules of engagement, deconfliction and containment planning, deliver prioritized findings and remediation guidance, and present results in readouts and workshops.
• Contribute to internal methodology, tooling, playbooks and reusable emulation and detection content.

Required profile

• Experience in offensive security, red teaming, purple teaming, detection engineering or a closely related discipline.
• Solid, hands-on understanding of MITRE ATT&CK and practical end-to-end adversary emulation or red team experience.
• Working knowledge of networking, Windows, Linux and Active Directory attack paths and their telemetry.
• Experience authoring or tuning detection rules in at least one major SIEM/detection platform.
• Clear written and verbal communication, including client-facing reports and readouts.
• Strong ethics, discipline and a safety-first mindset in production customer environments.

Required skills

• Preferred: OSCP, CRTO, OSEP, GCIH, GCFA, GCDA, GDAT or equivalent; MITRE ATT&CK Purple Teaming Methodology certification.
• Preferred: Sigma, EQL/KQL/SPL, detection-as-code pipelines, ATT&CK coverage tools (DeTT&CT, Atomic Red Team).
• Preferred: cloud (AWS/Azure/GCP) and Kubernetes attack and detection surfaces, threat intelligence-driven emulation, scripting (Python, PowerShell, Bash).

What we offer

• A wholly-owned subsidiary of GovTech.
• A learning culture with growth opportunities.
• Contract staff enjoy the same benefits as permanent employees.