ZipRecruiter

Log In

1

Cyber Deception Engineer Jobs (NOW HIRING)

World Wide Technology

Cyber Systems Engineer

San Diego, CA · On-site

$185K - $200K/yr

Technologies & Platforms Security & Deception * Splunk Enterprise, Splunk Phantom, ELK (Elastic ... WWT is seeking a Cyber Systems Engineer that will serve as a senior technical lead supporting the ...

Salesforce, Inc.

Job Category Software Engineering Job Details About Salesforce Salesforce is the #1 AI CRM, where ... defense capabilities, including cyber deception technology, decoys and honeypots, lures ...

MWI Buying Group

Summary The Senior Director of Cyber Defense Architecture & Engineering leads the strategy, design ... Deception technologies * Threat intelligence platforms * Security data lakes and analytics ...

next page

Showing results 1-20

All JobsTechnology JobsNetworking JobsNetwork Engineer JobsCyber Deception Engineer Jobs

Cyber Deception Engineer information

See salary details

$29.5K

$122.1K

$197.5K

How much do cyber deception engineer jobs pay per year?

As of Sep 11, 2026, the average yearly pay for cyber deception engineer in the United States is $122,108.00, according to ZipRecruiter salary data. Most workers in this role earn between $100,500.00 and $149,500.00 per year, depending on experience, location, and employer.

What is a cyber deception engineer?

A Cyber Deception Engineer is a cybersecurity professional who designs, implements, and manages deception technologies and strategies to detect, mislead, and thwart cyber attackers. Their work involves creating decoys, honeypots, and fake assets within networks to lure adversaries and gather intelligence on attack methods. By doing so, they help organizations identify threats early, study attacker behavior, and strengthen overall security posture. Cyber Deception Engineers often collaborate with incident response teams and use specialized tools to continuously adapt deception techniques to evolving cyber threats.

What are the key skills and qualifications needed to thrive as a cyber deception engineer?

To thrive as a Cyber Deception Engineer, you need a solid background in cybersecurity, networking, and threat analysis, often supported by a degree in computer science or a related field. Expertise with deception technologies, SIEM platforms, and certifications like CISSP or CEH are commonly required. Creative problem-solving, analytical thinking, and effective communication are essential soft skills for designing and implementing innovative deception strategies. These abilities are crucial for proactively identifying threats, misleading attackers, and enhancing an organization's overall security posture.

What are the main challenges faced by cyber deception engineers when designing and deploying deception environments?

Cyber Deception Engineers often face the challenge of creating realistic and adaptive deception environments that effectively lure and identify sophisticated attackers without disrupting legitimate network operations. Balancing the visibility of decoys with operational stealth, maintaining up-to-date deception assets, and ensuring seamless integration with existing security infrastructure are key hurdles. Success in this role usually requires continual learning and collaboration with incident response, threat intelligence, and IT teams to keep deception strategies relevant to evolving threats.

What is the difference between Cyber Deception Engineer vs Threat Hunter?

AspectCyber Deception EngineerThreat Hunter
CertificationsGCTI, CISSP, CEHGCTI, CISSP, CEH
Work EnvironmentDesigns deception tactics, implements honeypots, and manages deception toolsProactively searches for threats within networks using data analysis and threat intelligence
Industry UsageCybersecurity teams focusing on deception strategiesSecurity teams conducting threat detection and incident response

While both roles require similar certifications and work within cybersecurity, a Cyber Deception Engineer focuses on creating and managing deception technologies to mislead attackers, whereas a Threat Hunter actively searches for threats within networks to prevent breaches.

What are popular job titles related to Cyber Deception Engineer jobs?

For Cyber Deception Engineer jobs, the most frequently searched job titles are:

Infographic showing various Cyber Deception Engineer job openings in the United States as of September 2026, with employment types broken down into 98% Full Time, and 2% Contract. Highlights an 88% In-person, 2% Hybrid, and 10% Remote job distribution, with an average salary of $122,108 per year, or $58.7 per hour.

Security Engineer, Cyber Threat Intelligence

Austin, TX • On-site

Saronic Technologies
Guided Missile and Space Vehicle Manufacturing • 51 - 200 employees
Learn more about Saronic Technologiesexternal

Full-time

Medical, Dental, Vision, Life, Retirement, PTO

Re-posted 19 days ago

Job description

Saronic Technologies is a leader in revolutionizing autonomy at sea, dedicated to developing state-of-the-art solutions that enhance maritime operations through autonomous and intelligent platforms.
Job Overview
Security at Saronic is a force multiplier, not a blocker. An autonomous-maritime defense company is a top-tier target for nation-state and advanced criminal actors, and we're looking for a Security Engineer for Cyber Threat Intelligence to make sure we see them coming. This is a hands-on, doctrine-driven engineering role, not a reporting desk: you'll run a real intelligence program and turn raw indicators into operational defenses.
You'll work across Security Operations, Detection Engineering, Vulnerability Management, Physical Security, Insider Threat, Data Loss Prevention, and Red Team to focus on the adversaries targeting the defense industrial base.
This is an opportunity to help run the threat-intelligence function for a fast-growing defense company, fuse intelligence with detection engineering rather than isolating it as reporting, and directly shape how we anticipate threats to our vessels, supply chain, people, and data.
Responsibilities
  • Priority Intelligence Requirements & Collection: Help own and evolve our Priority Intelligence Requirements and collection-management framework, translating leadership decisions and our maritime-autonomy and defense-industrial-base threat model into tasked collection, hunts, and finished intelligence.
  • Adversary Tracking: Track the priority adversaries, including nation-state, APT, and advanced criminal actors most likely to target defense, maritime, and the broader industrial base, along with their tooling, infrastructure, and tradecraft, and maintain adversary and campaign profiles.
  • Turn Intelligence into Action: Operationalize indicators and TTPs into detections, hunts, and prioritized remediation, and build the pipelines and connectors that ingest, enrich, and correlate intel from commercial feeds and OSINT. Turn raw data into verified intelligence products that meaningfully influence decision-making at all levels of the organization.
  • Fuse Internal & External: Fuse external intelligence with internal telemetry in our graph-based intelligence data store, running attack-path and identity-to-asset correlation to prioritize by real exposure rather than CVSS alone.
  • Finished Intelligence: Produce concise, actionable intelligence and briefings for security leadership and cross-functional partners, applying analytic tradecraft, estimative language, calibrated confidence, and structured analytic techniques, and modeling with STIX and MITRE ATT&CK.
  • Hunting & Detection: Develop and run intelligence-driven threat hunts across endpoint, cloud, identity, email, and network telemetry, and author durable detections (Sigma, YARA) with detection engineering and incident response.
  • Infrastructure & Malware Analysis: Perform infrastructure pivoting (passive DNS, certificate pivoting, WHOIS/ASN) and malware triage to extract indicators, TTPs, and attribution signals.
  • Digital Risk & Identity Protection: Run deep and dark-web, breach-credential, and identity-exposure monitoring, including account-takeover, executive and VIP protection, and brand-impersonation, and coordinate takedowns with Legal, Comms, and IT.
  • Deception & Automation: Help design and operate cyber-deception sensors (honeytokens, canaries, decoys) for high-fidelity, low-noise alerts, and build case-automation and in-case AI-agent workflows for enrichment and triage.

Qualifications
  • 4+ years in cyber threat intelligence, threat hunting, detection engineering, or intrusion analysis, or an equivalent combination of experience and demonstrated ability, with demonstrable tracking of sophisticated or state-sponsored adversaries that drove detection, hunting, or response
  • Fluency with the intelligence lifecycle, Priority Intelligence Requirements and collection management, and structured analytic techniques, and the ability to produce finished intelligence with calibrated confidence
  • Strong software engineering to build automation, connectors, and data pipelines end to end
  • Working command of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain, plus STIX/TAXII for modeling and sharing intelligence
  • Hands-on infrastructure and log analysis (passive DNS, certificate pivoting, WHOIS/ASN) and detection authoring (Sigma, YARA, or SIEM-native)
  • Ability to obtain and maintain a U.S. security clearance

Preferred Qualifications:
  • Nation-state/APT tracking relevant to the defense industrial base, maritime, or manufacturing industries
  • Standing up or operating an in-house or graph-based CTI platform, MISP, or a TAXII/STIX pipeline
  • Malware analysis and adversary attribution (provisional clustering; tactical, operational, and strategic attribution)
  • Cyber-deception design and operations (honeytokens, canaries, decoys)
  • Digital risk protection and dark-web tradecraft: breach-credential, executive-protection, and brand-impersonation monitoring and takedowns
  • Applying LLMs and AI tooling to accelerate collection, enrichment, and analysis, including agentic case automation
  • DoD/DIB context (CMMC/NIST 800-171, GovCloud, ITAR) and military intelligence doctrine
  • OT/ICS or maritime security knowledge
  • Public CTI research, talks, or open-source contributions
  • If your experience doesn't line up with every preferred qualification, we still encourage you to apply; we hire for demonstrated ability and outcomes.

Physical Demands
  • Prolonged periods of sitting at a desk and working on a computer
  • Occasional standing and walking within the office
  • Manual dexterity to operate a computer keyboard, mouse, and other office equipment
  • Visual acuity to read screens, documents, and reports
  • Occasional reaching, bending, or stooping to access file drawers, cabinets, or office supplies
  • Lifting and carrying items up to 20 pounds occasionally (e.g., office supplies, packages)

Benefits
Medical Insurance: Comprehensive health insurance plans covering a range of services
Saronic pays 100% of the premium for employees and 80% for dependents
Dental and Vision Insurance: Coverage for routine dental check-ups, orthodontics, and vision care
Saronic pays 100% of the premium under the basic plan for employees and 80% for dependents
Time Off: Generous PTO and Holidays
Parental Leave: Paid maternity and paternity leave to support new parents
Competitive Salary: Industry-standard salaries with opportunities for performance-based bonuses
Retirement Plan: 401(k) plan with company match
Stock Options: Equity options to give employees a stake in the company's success
Life and Disability Insurance: Basic life insurance and short- and long-term disability coverage
Pet Insurance: Discounted pet insurance options including 24/7 Telehealth helpline
Additional Perks: Free lunch benefit and unlimited free drinks and snacks in the office
Saronic CCPA Notice for Candidates and California Employees
If this role is based in the United States, it requires access to export-controlled information or items that require "U.S. Person" status. As defined by U.S. law, individuals who are any one of the following are considered to be a "U.S. Person": (1) U.S. citizens, (2) legal permanent residents (a.k.a. green card holders), and (3) certain protected classes of asylees and refugees, as defined in 8 U.S.C. 1324b(a)(3).
Saronic does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity or any other reason prohibited by law in provision of employment opportunities and benefits. We are also committed to providing reasonable accommodations for qualified individuals with disabilities.

Apply