Cyber Security Research Engineer

Job Description :

We are seeking a highly skilled Cybersecurity Research Engineer Honeypot with strong expertise in honeypot deployment, threat research, and APT attribution. The role involves designing deception-based security systems, conducting deep adversary analysis, and supporting threat intelligence and incident response efforts.

Key Responsibilities :

- Design, deploy, and manage low-, medium-, and high-interaction honeypots across IT, cloud, and OT environments

- Develop custom honeypots and decoys for specific threat actor profiling and campaign tracking

- Monitor, analyze, and triage honeypot-generated telemetry (network, system, malware artifacts)

- Perform APT attribution using TTP analysis mapped to MITRE ATT&CK framework

- Correlate honeypot intelligence with threat intelligence feeds, OSINT, malware reports, and darknet sources

- Support incident response and threat hunting teams with actionable intelligence

- Produce research-grade reports including attack timelines, infrastructure analysis, and attribution confidence levels

- Continuously research emerging APT campaigns, zero-day exploitation trends, and deception techniques

Required Skills & Experience :

Technical Skills :

- Hands-on experience with honeypot frameworks (e.g., Cowrie, Dionaea, Honeytrap, Conpot, OpenCanary, T-Pot)

- Strong understanding of APT TTPs, kill chain analysis, and adversary tradecraft

- Proficiency in Linux system administration and networking (TCP/IP, DNS, HTTP, SMB, SSH)

- Scripting skills in Python / Bash for automation and data analysis

- Knowledge of MITRE ATT&CK, Diamond Model, Cyber Kill Chain

Research & Attribution Skills :

- Ability to link infrastructure, malware families, and behaviors to known or emerging APT groups

- Experience in false-flag detection and attribution confidence scoring

- Strong understanding of C2 infrastructure, payload delivery mechanisms, and lateral movement techniques

Preferred / Good-to-Have :

- Experience with OT/ICS honeypots (Modbus, DNP3, IEC 104, BACnet)

- Exposure to cloud-based deception technologies

- Familiarity with memory forensics and sandboxing tools

- Prior experience working in SOC, CERT, cyber range, or national-level cybersecurity programs

- Published research, blogs, or conference talks on threat research or deception technologies

Educational Background : B.Tech / M.Tech / MSc in Computer Science, Cybersecurity, or related field