2 Snort Jobs in India

About the role

You will create and validate the detection content that protects our customers: IDPS signatures, application control rules, and DLP rules. This is a hands-on role in our security lab, where you will generate real attack traffic, research vulnerabilities and applications, and make sure every rule is accurate, effective, and ready for production.

What you'll do

Write security rules

• Write IDPS signatures for exploits, malware, command-and-control traffic, and network attacks, with the right severity, action (alert / block / reject), and protocol scope
• Build application control rules to identify and control social media, streaming, file sharing, remote access, unsanctioned SaaS, and AI tools
• Create DLP rules to detect sensitive data (personal and financial data, confidential documents, source code) across web, email, and file transfer channels

Test and validate

• Set up test scenarios in our lab and generate traffic using browsers, command-line tools, packet captures, and safe proof-of-concept exploits
• Confirm that each rule triggers and that logs show the correct rule, severity, action, and source
• Test against normal everyday traffic to find and fix false positives before rules ship
• Build and maintain a repeatable test set so rules keep working after product updates

Research and document

• Track new CVEs, exploit techniques, and emerging applications, and turn them into working detections
• Study public r
• Study public rulesets to learn coverage patterns and find gaps in our own
• Write a short validation note for each batch: what it detects, how it was tested, and what it doesn't cover

What we're looking for

• 2-5 years of hands-on experience writing detection rules or signatures with Snort, Suricata, Zeek, YARA, Sigma, or similar
• Strong networking fundamentals: TCP/IP, HTTP/HTTPS, DNS, TLS, and packet analysis with Wireshark or pcap tools
• Experience testing rules with PoC exploits and tuning them to reduce false positives
• Exposure to CVE and vulnerability research, with the ability to read advisories and turn them into detections
• Working knowledge of Python or Bash for test automation, and comfort with Linux
• Clear written communication, since you'll document what each rule covers and what it doesn't

Good to have

• Experience with deep packet inspection, application identification (nDPI or similar), or DLP regex and pattern work
• Background at a network security vendor (firewall, IPS, NGFW, secure web gateway)
• Public work such as GitHub rules, blog posts, CVE credits, or CTF participation

This role is not

A SOC monitoring, alert triage, or pure penetration testing role. We are looking for people who write and test detection rules.

Important: Please note there are no Cisco, Juniper or any other proprietary devices to be administered. We are looking for candidates willing to work on GNU/Linux powered network equipment.

We at Unmukti build network equipment and provide managed network services to organisations having geographically dispersed locations across the country.

Our equipment run GNU/Linux firmware but still the networking concepts remain the same.

For the impatient, we need following skills:

• Debian/Ubuntu GNU/Linux
• iptables / nftables
• Squid / ICAP
• OpenVPN
• Wireguard
• Snort / Suricata
• Postgresql
• git
• patch/diff, ./configure, make
• OSPF & BGP on BIRD or Quagga
• ansible
• bash / Perl / Python / Go

Now in detail:

We have servers to be managed, databases to be administered, embedded devices to run GNU/Linux and customers to be supported who are using those devices for various networking services that we provide.

We want someone with experience on Debian or Ubuntu as primary OS, knows networking concepts . Bonus if you know your way around to automate stuff with bash/Go/Perl/Python etc.

Experience in Network Design for connecting large number of geographically distributed locations ( >= 20 is considerable, though >=200 would be great) and understanding of routing protocols like OSPF and BGP will be an added advantage.

You get insights into networking (wireless too), network security and product development.

Along with that, you will have to design and support be-spoke deployments and handle operational issues on a day-to-day basis.