Android Security Research Engineer

C3iHub, IIT Kanpur; Delhi; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

C3iHub, IIT Kanpur is seeking an Android Security Research Engineer to explore Android internals, perform reverse engineering, and conduct deep vulnerability research at both application and system levels. You will tackle exploit analysis, runtime manipulation, and security testing across kernel and framework surfaces.

The role emphasizes hands-on security research, bypassing common controls, and developing custom tooling with Frida/Objection while collaborating on vulnerability research and

Qualifications

• Strong understanding of Android fundamentals and Android internals (framework and system architecture).
• Hands-on experience with Android kernel concepts and attack surface awareness.
• Proven experience in reverse engineering Android applications.
• Strong hands-on knowledge of Android application penetration testing methodologies.
• Experience replicating and analyzing known Android exploits and adapting PoCs.
• Familiarity with exploit chaining concepts in mobile attack scenarios.
• Hands-on experience working with Corellium Android environments for security research and testing.
• Practical experience bypassing SSL pinning, root detection, anti-debugging and runtime protections.
• Experience with runtime instrumentation and traffic interception.

Responsibilities

• Perform reverse engineering of Android applications (APK/AAB) to identify security flaws and weak security implementations.
• Conduct Android application penetration testing, including runtime manipulation, hooking, and traffic interception.
• Analyze and bypass SSL pinning, root detection, anti-debugging, tamper protection, and obfuscation.
• Research Android internals including the framework, ART/Dalvik runtime, system services, Binder IPC, and permission model.
• Perform dynamic and static analysis of Android malware and suspicious apps (good to have).
• Develop, customize, and maintain Frida scripts, Objection workflows, and custom tooling for security research.
• Replicate and analyze known Android vulnerabilities and exploits to understand root causes and impact.
• Assist in vulnerability research and exploitation, including logic flaws and basic memory corruption concepts.

Skills

Android internals

Reverse engineering

Android application pentesting

Exploit analysis

Android kernel concepts

Security research

Vulnerability research

Exploit chaining concepts

Dynamic analysis

Static analysis

Tools

Frida

Objection

Pidcat

Burp Suite

Metasploit

ADB

Android Studio

Corellium Android environments

Job description

Role Overview

We are looking for an Android Security Research Engineer who is passionate about understanding Android internals, breaking application and platform defenses, and conducting deep vulnerability research at both the application and system level. The ideal candidate has strong hands-on experience in reverse engineering, mobile application pentesting, exploit analysis, and security research, with exposure to kernel- and framework-level attack surfaces.

Key Responsibilities

• Perform reverse engineering of Android applications (APK/AAB) to identify security flaws, logic issues, and weak security implementations
• Conduct Android application penetration testing, including runtime manipulation, hooking, and traffic interception
• Analyze and bypass common mobile security controls such as SSL pinning, root detection, anti-debugging, tamper protection, and obfuscation
• Research Android internals including the Android framework, ART/Dalvik runtime, system services, Binder IPC, and permission model
• Perform dynamic and static analysis of Android malware and suspicious applications (good to have)
• Develop, customize, and maintain Frida scripts, Objection workflows, and custom tooling for security research
• Replicate and analyze publicly known Android vulnerabilities and exploits to understand root causes and impact
• Assist in vulnerability research and exploitation, including logic flaws, exploit chaining, and basic memory corruption concepts

Must-Have Skills

• Strong understanding of Android fundamentals and Android internals (framework and system architecture)
• Hands-on experience with Android kernel concepts and attack surface awareness
• Proven experience in reverse engineering Android applications
• Strong hands-on knowledge of Android application penetration testing methodologies
• Experience replicating and analyzing known Android exploits and adapting PoCs
• Familiarity with exploit chaining concepts in mobile attack scenarios
• Hands-on experience working with Corellium Android environments for security research and testing
• Practical experience bypassing:
• SSL pinning
• Root detection
• Anti-debugging and runtime protections
• SSL pinning
• Root detection
• Anti-debugging and runtime protections
• Experience with runtime instrumentation and traffic interception
• Familiarity with tools including (but not limited to):
• ADB
• Android Studio
• Frida
• Objection
• Pidcat
• Burp Suite
• Metasploit
• ADB
• Android Studio
• Frida
• Objection
• Pidcat
• Burp Suite
• Metasploit
• Basic understanding of exploitation techniques and vulnerability research concepts

Good-to-Have Skills

• Experience with Android malware analysis
• Hands-on experience with:
• Bootloader unlocking
• Rooting Android devices
• Custom ROMs or recovery environments
• Bootloader unlocking
• Rooting Android devices
• Custom ROMs or recovery environments
• Familiarity with native components (NDK), JNI, and ARM64

Scripting skills (Python, JavaScript for Frida, Bash)

Required Skills

• Cyber-security
• Android