Android Security Research Engineer

C3iHub, IIT Kanpur; Delhi; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

C3iHub, IIT Kanpur invites an Android Security Research Engineer to explore Android internals, reverse engineer apps, and analyze exploitation techniques across app and system surfaces. You will perform dynamic and static analysis, study malware behavior, and contribute to vulnerability research.

The role focuses on Frida scripting, runtime testing, bypassing security controls, and understanding kernel/framework attack surfaces with collaboration across security teams.

Qualifications

• Strong Android fundamentals and internals knowledge.
• Hands-on Android application security testing experience.
• Experience with reverse engineering of apps and exploit analysis.
• Familiarity with Frida, Objection and dynamic instrumentation.
• Experience analyzing and bypassing security controls (SSL pinning, root detection, anti-debug).
• Ability to study Android framework, ART/Dalvik, and Binder IPC.

Responsibilities

• Perform reverse engineering of Android apps to identify security flaws and logic issues.
• Conduct Android app pentesting including runtime manipulation and traffic interception.
• Analyze bypass techniques for common controls like SSL pinning and anti‑debug.
• Research Android internals including framework, ART/Dalvik, system services, and permissions.
• Develop and maintain Frida scripts, Objection workflows, and custom tooling.
• Replicate known Android vulnerabilities and understand root causes.

Skills

Android fundamentals

Android internals

Reverse engineering

Android application pentesting

Exploitation concepts

Runtime instrumentation

Security research

Security testing methodology

Tools

ADB

Frida

Objection

Pidcat

Burp Suite

Job description

We are looking for an Android Security Research Engineer who is passionate about understanding Android internals, breaking application and platform defenses, and conducting deep vulnerability research at both the application and system level. The ideal candidate has strong hands‑on experience in reverse engineering, mobile application pentesting, exploit analysis, and security research, with exposure to kernel‑ and framework‑level attack surfaces.

Key Responsibilities

• Perform reverse engineering of Android applications (APK/AAB) to identify security flaws, logic issues, and weak security implementations
• Conduct Android application penetration testing, including runtime manipulation, hooking, and traffic interception
• Analyze and bypass common mobile security controls such as SSL pinning, root detection, anti-debugging, tamper protection, and obfuscation
• Research Android internals including the Android framework, ART/Dalvik runtime, system services, Binder IPC, and permission model
• Perform dynamic and static analysis of Android malware and suspicious applications (good to have)
• Develop, customize, and maintain Frida scripts, Objection workflows, and custom tooling for security research
• Replicate and analyze publicly known Android vulnerabilities and exploits to understand root causes and impact
• Assist in vulnerability research and exploitation, including logic flaws, exploit chaining, and basic memory corruption concepts

Must-Have Skills

• Strong understanding of Android fundamentals and Android internals (framework and system architecture)
• Hands‑on experience with Android kernel concepts and attack surface awareness
• Proven experience in reverse engineering Android applications
• Strong hands‑on knowledge of Android application penetration testing methodologies
• Experience replicating and analyzing known Android exploits and adapting PoCs
• Familiarity with exploit chaining concepts in mobile attack scenarios
• Hands‑on experience working with Corellium Android environments for security research and testing
• Practical experience bypassing:
• SSL pinning
• Anti‑debugging and runtime protections
• SSL pinning
• Anti‑debugging and runtime protections
• Experience with runtime instrumentation and traffic interception
• Familiarity with tools including (but not limited to):
• ADB
• Frida
• Objection
• Pidcat
• Burp Suite
• ADB
• Frida
• Objection
• Pidcat
• Burp Suite
• Basic understanding of exploitation techniques and vulnerability research concepts

Good‑to‑Have Skills

• Experience with Android malware analysis
• Hands‑on experience with:
• Custom ROMs or recovery environments
• Custom ROMs or recovery environments
• Familiarity with native components (NDK), JNI, and ARM64