Senior Cybersecurity Research Engineer / Security Researcher

About the Company

Turtleneck Systems & Solutions Pvt. Ltd. is an Indian cybersecurity startup providing next-generation security solutions to private industries, government organizations, Public Sector Undertakings (PSUs), and defense establishments. The company is ISO 9001:2015 and ISO/IEC 27001:2022 certified and incubated with DSC. Turtleneck focuses on developing advanced cybersecurity capabilities to address evolving security challenges.

What We're Looking For

A curious, technically rigorous professional who can work with complex systems and explore challenging security problems. The ideal candidate will combine strong analytical thinking with practical engineering skills to translate research into actionable findings, reusable tools, proof-of-concepts, and meaningful cybersecurity capabilities.

Job Overview

• Job Title: Senior Cybersecurity Research Engineer / Security Researcher
• Company: Turtleneck Systems & Solutions Pvt. Ltd.
• Location: Noida, Uttar Pradesh
• Employment Type: Full-time, Permanent
• Industry: Computer and Network Security
• Department: Cybersecurity / Security Research
• Vacancies: 1
• Salary: Best in Industry

Role Summary

A technically proficient and research-oriented cybersecurity professional with expertise in security research, vulnerability analysis, AI security, reverse engineering, cloud security, and operating-system internals. Responsibilities include investigating emerging security threats, analyzing complex systems, researching vulnerabilities, developing proof-of-concept implementations, and building tools to strengthen next-generation cybersecurity capabilities.

Key Responsibilities

• Advanced Cybersecurity Research
• Research emerging cybersecurity threats, attack techniques, vulnerabilities, and security mechanisms.
• Analyze enterprise technologies and identify potential security weaknesses.
• Map research findings to established frameworks such as MITRE ATT&CK and MITRE ATLAS.
• Prepare technical research reports, security advisories, and proof-of-concept implementations.
• AI and Emerging Technology Security
• Investigate security risks associated with Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), AI agents, and AI-enabled applications.
• Research prompt injection, jailbreak techniques, RAG poisoning, agentic tool abuse, and multimodal AI security.
• Contribute to AI-driven security research, automation, and security tooling.
• Security Framework and Infrastructure Research
• Evaluate modern security frameworks and infrastructure used in authorized research and adversary simulation.
• Analyze framework architecture, communication mechanisms, agents, extensions, profiles, and security controls.
• Identify security weaknesses and opportunities for improving existing research capabilities.
• Vulnerability and Systems Security Research
• Investigate memory-safety issues, including stack and heap vulnerabilities, use-after-free conditions, and related weaknesses.
• Research operating-system security mechanisms, kernel security, and modern mitigation technologies.
• Develop controlled proof-of-concept implementations to validate findings.
• Analyze vulnerability chains across applications, operating systems, and enterprise technologies.
• Reverse Engineering and Malware Analysis
• Perform static and dynamic analysis of binaries, malware samples, and suspicious software components.
• Use tools such as Ghidra, IDA Pro, WinDbg, and x64dbg for reverse engineering and debugging.
• Analyze software behavior and security mechanisms.
• Develop YARA rules and reusable research artifacts.
• Cloud and Infrastructure Security
• Conduct security research across AWS, Microsoft Azure, and Google Cloud Platform (GCP).
• Investigate cloud IAM configurations, privilege boundaries, container security, and Kubernetes environments.
• Analyze CI/CD pipelines, software supply-chain risks, and cloud-native architectures.
• Identify potential infrastructure weaknesses and recommend security improvements.
• Application and Document Security Research
• Investigate vulnerabilities in enterprise applications and commonly used document formats.
• Research DOCX, RTF, OLE, and related technologies from a security perspective.
• Analyze publicly disclosed vulnerabilities and emerging enterprise software security issues.
• Develop controlled proof-of-concept implementations for validated findings.
• Security Tooling and Proof-of-Concept Development
• Develop research tools, scripts, utilities, and proof-of-concept implementations using C, C++, Python, Rust, or Go.
• Apply AI-assisted development techniques.
• Build custom tools when existing solutions do not meet research requirements.
• Contribute to reusable internal security frameworks and research capabilities.
• Vulnerability Disclosure and Technical Documentation
• Research vulnerabilities in security frameworks, enterprise software, and cybersecurity products.
• Investigate authorization weaknesses, vulnerability chains, remote-code-execution conditions, denial-of-service conditions, and other security-impacting issues.
• Prepare technical documentation for responsible vulnerability disclosure.
• Contribute to CVE research, technical advisories, research papers, blogs, and security publications.
• Knowledge Sharing and Continuous Learning
• Prepare detailed technical reports and executive-level summaries of research findings.
• Document methodologies, technical observations, proof-of-concept results, impact, and recommendations.
• Support mentoring and internal knowledge-sharing initiatives.
• Stay updated on emerging vulnerabilities, cybersecurity research, technologies, and industry developments.

Requirements & Tech Stack

• Experience: 25 years of experience in cybersecurity, security research, advanced security engineering, or related technical security domains.
• Certifications: OSCP or a related certification such as OSEP, OSWE, CRTO, or CRTP.
• AI Security Research:
• Knowledge of LLM security, prompt injection, the OWASP LLM Top 10, AI agent security, and RAG security.
• Familiarity with MITRE ATLAS and emerging AI security threats.
• Cloud and Infrastructure Security:
• Working knowledge of AWS, Azure, or GCP.
• Understanding of Docker, Kubernetes, cloud IAM, CI/CD security, and cloud infrastructure security.
• Security Research and Adversary Simulation:
• Familiarity with security frameworks and tools such as Mythic, Sliver, Havoc, Cobalt Strike, and BloodHound.
• Understanding of Active Directory security and related research areas.
• Memory and Operating-System Security:
• Knowledge of memory corruption, exploit development, shellcode, ROP/JOP, kernel security, and security mitigation analysis.
• Understanding of Windows and Linux internals, process architecture, PE format, system calls, and kernel debugging.
• Familiarity with Windows security mechanisms, including Defender, AMSI, ETW, and firewall security.
• Reverse Engineering and Malware Analysis:
• Experience with Ghidra, IDA Pro, WinDbg, or x64dbg.
• Understanding of static and dynamic binary analysis, reverse engineering, and malware analysis.
• Programming and Tool Development:
• Proficiency in one or more of C, C++, Python, Rust, or Go.
• Ability to develop scripts, utilities, research tools, and proof-of-concept implementations.
• Security Frameworks:
• Familiarity with MITRE ATT&CK, MITRE ATLAS, OWASP, and PTES.