Product Security Engineer- Mobile App Security

Description: 

Product Security Engineer will be responsible for end-to-end security testing with a focus on Android/iOS application security. The successful candidate will be a highly technical, passionate, and self-driven individual who loves to learn, solve problems, and contribute to the advancement of the team.

Summary:

• Mobile Application Security Engineer will be responsible for conducting manual and automated Security testing and requirements verification such as MASVS/CWEs on iOS/Android application
• Perform security assessment, and penetration testing including but not limited to mobile application binary analysis, source code review, IPC, and SDK analysis
• Experience analyzing the application sandbox on iOS and Android privilege issues[D(1]
• Participate in the mobile application development, and facilitate the security requirements development and verification
• Identify hardcoded secrets, insecure storage, insecure communication, improper permissions, sensitive disclosure, and insecure use and validation of data entering platform features (i.e. DeepLinks, Exported Activities/Content Providers).
• Identify weak or deprecated algorithms used in 3rd party and internal libraries
• Produce reports/artifacts, recommendations for remediations, and provide support to strengthen the security posture of Android/iOS applications
• Familiarity with Mobile Security Testing Guide and ability to leverage the framework and test both iOS and Android applications
• Participate in various security projects, technical design review, code review, and test specifications
• Identify the use of deprecated mobile components and methods such as WebViews and vulnerable programmatic deeplink handlers

Requirements

Requirements

• Hands-on experience performing security assessments on OS or application-level of iOS/Android applications
• Strong understanding of security testing framework for Android/iOS applications (e.g., OWASP, SANS)
• Advance skills in secure coding best practices in any programming languages such as C/C++, Java, Objective C, Swift, SwiftUI, Kotlin, and Python
• The successful candidate will be a highly technical, passionate, and self-driven individual who loves to learn, solve problems, grow, and contribute to the advancement of the team
• Knowledge of Inter Process Communication (IPC) on Mobile Platforms
• Proficient in writing scripts in various languages such as Bash, and Python
• Proficient knowledge of APIs, and authentication protocols such as OAuth, SAML, etc.
• Knowledge of software development lifecycle (SDLC), cloud security, and iOS/Android reverse engineering
• Hand-On experience on testing tools such as Burp Suite, Frida, dissemblers, debuggers, dynamic instrumentations, and static code analysis
• Ability to articulate complex technical concepts to a non-technical audience
• Experience mobile application CI/CD pipeline
• Generating test reports, and recommending the appropriate course of action, and supporting the mitigation and re-validation efforts

Qualifications:

• Bachelor’s degree (or higher) in Computer Science, Engineering or related discipline, or equivalent experience
• Strong background in security engineering, various authentication, and security protocols
• Strong understanding of Mobile OS security internals
• Hand-On experience with security testing tools, standards, and best practices
• Deep experience in mobile security, obfuscation techniques, and reverse engineering
• Strong knowledge and understanding of X.509, SSL/TLS certificate, and general certificate management process