Cyber Simulation Exercises Scenario Developer

About the Role

FNRCO is seeking a Cyber Simulation Exercises Scenario Developer to join their team in Riyadh, Riyadh Region. This full-time role focuses on designing, building, and delivering large-scale cybersecurity simulation exercises to enhance workforce cyber capabilities. The developer will create realistic scenarios on a cyber range platform, develop exercise "injects" and artifacts, and maintain the supporting lab infrastructure for scalable and measurable training.

Key Responsibilities

• Design end-to-end cyber simulation exercises aligned with organizational capability uplift goals, covering areas such as phishing response, ransomware, cloud misconfigurations, insider threats, and incident response coordination.
• Translate learning objectives into engaging storylines, technical objectives, and measurable outcomes for exercises.
• Develop multi-track scenarios tailored for diverse audiences including IT, SOC, incident commanders, and executives, ensuring appropriate complexity and realism.
• Ensure scenarios accurately reflect the current threat landscape and common enterprise environments (*, Windows/Linux, AD, email, web applications, cloud, endpoints).
• Produce comprehensive exercise packages, including facilitator guides, participant instructions, runbooks, timelines, scoring rubrics, and debrief materials.
• Create realistic artifacts such as emails, chat transcripts, tickets, logs, alerts, threat intelligence snippets, media statements, executive briefings, and policy references.
• Build assessment content, including pre/post checks, knowledge validations, and performance-based evaluation criteria.
• Design and manage technical and non-technical exercise injects to drive decision-making and actions during simulations.
• Implement inject delivery mechanisms within the cyber range, utilizing automated triggers, timed releases, and event-driven injects.
• Coordinate inject timing, escalation paths, and branching logic based on participant actions.
• Build and configure lab environments necessary for scenarios, including networks, endpoints, servers, identity services, and security tooling.
• Integrate common security tools and telemetry sources (*, SIEM, EDR, IDS, email security, vulnerability scanners) as required by the exercise.
• Support dry runs, pilot sessions, and production execution, troubleshooting technical issues during live exercises.
• Provide facilitators with clear runbooks, decision points, and expected participant actions.
• Capture exercise telemetry and participant performance data for reporting and continuous improvement.
• Define KPIs and scoring models, such as time-to-detect, time-to-contain, decision quality, process adherence, and communication effectiveness.
• Produce post-exercise reports and lessons learned, recommending improvements to content, controls, and processes.

Experience and Qualifications

• Candidates should possess 5-10 years of relevant experience in cybersecurity, simulation development, or a related field.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia. The role involves working within a team focused on enhancing cybersecurity capabilities through advanced simulation exercises.