Mobile Application Penetration Tester (iOS & Android)
- India
- Permanent
- Full-time
- Conduct end-to-end penetration testing of iOS and Android apps, including static, dynamic, and runtime analysis.
- Evaluate mobile API integrations, authentication, encryption, and data storage mechanisms.
- Identify and exploit critical vulnerabilities such as insecure storage, weak cryptography, jailbreak/root bypasses, insecure code, and logic flaws.
- Utilize runtime instrumentation frameworks (Frida, Objection, Xposed) for advanced dynamic testing.
- Perform certificate pinning bypass, hooking, and traffic interception with advanced proxy techniques.
- Assess and attempt evasion of app protections (root/jailbreak detection, code obfuscation, anti-debugging, tamper protection).
- Develop custom scripts and exploits in Python, Java, Swift, Kotlin, or C++ to simulate advanced attacks.
- Produce detailed penetration test reports with risk ratings, PoCs, and actionable remediation guidance.
- Support Red Team exercises by simulating adversarial mobile endpoint attacks.
- Collaborate with development and security stakeholders to integrate secure coding and SDLC practices.
- 5+ years in penetration testing, with at least 3 years focused on iOS and Android apps.
- Solid knowledge of OWASP Mobile Top 10 and NIST guidelines.
- Expertise with tools for static & reverse engineering (Apktool, JADX, Ghidra, Hopper, IDA Pro, Radare2, JD-GUI).
- Advanced experience in runtime/dynamic testing using Frida, Objection, Cycript, LLDB, and Xposed.
- Familiarity with automation frameworks (MobSF, Drozer, Appium) and proxy tools (Burp Suite Pro, OWASP ZAP, MITM tools).
- Strong understanding of Android and iOS security internals, including sandboxing, Keychain, Secure Enclave, and OS models.
- Hands-on use of jailbroken and rooted devices for advanced exploitation.
- Knowledge of cryptography, TLS, cert pinning, and secure storage.
- Ability to think creatively like an attacker, going beyond automated findings.
- Preferred certifications: OSCP, OSEP, OSED, OSWE, OSMR, EWPTX, EWAPT, CRTP, CRTE (others like CEH or CAP are considered a plus).
- Competitive salary aligned with expertise and experience.
- Remote-first flexibility with a focus on work-life balance.
- Opportunity to work with leading-edge mobile security technologies.
- Professional growth through advanced projects and Red Team exercises.
- Access to certifications, training, and career development programs.
- Inclusive and collaborative environment promoting innovation.
- Health and wellness benefits package.
🔍 Our AI evaluates your CV and LinkedIn profile thoroughly, analyzing your skills, experience, and achievements.
📊 It compares your profile to the job’s core requirements and past success factors to determine your match score.
🎯 Based on this analysis, we automatically shortlist the 3 candidates with the highest match to the role.
🧠 When necessary, our human team may perform an additional manual review to ensure no strong profile is missed.The process is transparent, skills-based, and free of bias — focusing solely on your fit for the role. Once the shortlist is completed, we share it directly with the company that owns the job opening. The final decision and next steps (such as interviews or additional assessments) are then made by their internal hiring team.Thank you for your interest!#LI-CL1