Cyber Simulation Exercises Scenario Developer
Summary The Cyber Simulation Exercises Scenario Developer designs, builds, and delivers largescale cybersecurity simulation exercises (Threat Hunting Event, Live Fire Exercises,Capture the Flag) to uplift workforce cyber capability. This role develops realistic scenarioson a cyber range platform, creates exercise “injects” and artifacts, and builds/maintainsthe supporting lab infrastructure to enable repeatable, measurable training at scale.
Key Responsibilities1) Cyber Range Exercise & Scenario Development- Design end-to-end cyber simulation exercises aligned to organizationalcapability uplift goals (e.g., phishing response, ransomware, cloudmisconfigurations, insider threat, incident response coordination).- Translate learning objectives into engaging storylines, technical objectives, andmeasurable outcomes.- Develop multi-track scenarios for different audiences (IT, SOC, incidentcommanders, and executives) with appropriate complexity and realism.- Ensure scenarios reflect current threat landscape and common enterpriseenvironments (Windows/Linux, AD, email, web applications, cloud, endpoints).2) Content Creation (Exercise Materials & Artifacts)- Produce complete exercise packages including: facilitator guides, participantinstructions, runbooks, timelines, scoring rubrics, and debrief materials.- Create realistic artifacts: emails, chat transcripts, tickets, logs, alerts, threatintel snippets, media statements, executive briefings, and policy references.- Build assessment content (pre/post checks, knowledge validations,performance-based evaluation criteria).3) Inject Design & Orchestration- Create and manage exercise injects (technical and non-technical) to drivedecision-making and actions during the simulation.- Implement inject delivery mechanisms within the cyber range (automatedtriggers, timed releases, event-driven injects).- Coordinate inject timing, escalation paths, and branching logic based onparticipant actions.4) Cyber Range Infrastructure Build & Maintenance- Build and configure lab environments required for scenarios (networks,endpoints, servers, identity services, security tooling).- Integrate common security tools and telemetry sources (SIEM, EDR, IDS, emailsecurity, vulnerability scanners) as required by the exercise.5) Exercise Delivery Support & Facilitation Enablement- Support dry runs, pilot sessions, and production execution; troubleshoottechnical issues during live exercises.- Provide facilitators with clear runbooks, decision points, and expectedparticipant actions.- Capture exercise telemetry and participant performance data for reporting andcontinuous improvement.6) Measurement, Reporting & Continuous Improvement- Define KPIs and scoring models (time-to-detect, time-to-contain, decisionquality, process adherence, communication effectiveness).- Produce post-exercise reports and lessons learned; recommend improvementsto content, controls, and processes. Required Qualifications- Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, orequivalent practical experience.- Proven experience developing cybersecurity simulation exercises on a cyberrange platform (hands-on).- Demonstrated ability to create injects and exercise artifacts that drive realisticparticipant behavior.- Experience building and operating lab infrastructure (virtualized or cloud-based)for cyber scenarios.- Strong understanding of incident response lifecycle, common attacktechniques, and defensive controls. Required Technical Skills- Cyber range platforms: hands-on experience with at least one commercial oropen cyber range solution (platform-agnostic, but must have realimplementation experience).- Infrastructure: virtualization and networking fundamentals (segmentation,routing, DNS, AD basics).- OS & enterprise tech: Windows/Linux administration basics; Active Directoryconcepts.- Automation/scripting: Power Shell, Python, Bash (at least one strong).- Logging/monitoring concepts: SIEM/EDR telemetry, log sources, alerting logic.