Security Consultant

We are hiring a Security Consultant who lives and breathes mobile application security. You will assess iOS and Android apps for our clients, find the flaws that matter, and help engineering teams fix them for good. This is a hands‑on, client‑facing consulting role. Perform penetration tests and security assessments of iOS and Android applications, including the APIs and back‑end services they depend on Reverse engineer and instrument mobile apps (static and dynamic analysis, runtime hooking, traffic interception, certificate‑pinning and root/jailbreak‑detection bypass) Test against the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG) Write clear, actionable reports with reproducible steps, risk ratings and practical remediation guidance Contribute to internal tooling, testing methodology and knowledge sharing across the consulting team Scope engagements and support pre‑sales conversations as a mobile security subject matter expert 4+ years in offensive security or application security, with at least 1 year focused on mobile application testing ~ Deep, demonstrable experience assessing both iOS and Android apps, including native (Swift/Objective‑C, Kotlin/Java) and cross‑platform frameworks (React Native, Flutter, Xamarin) ~ Fluency with the mobile testing toolchain: Frida, Objection, Burp Suite, MobSF, jadx, apktool, Hopper or Ghidra, and the iOS/Android debugging and instrumentation stack ~ Solid understanding of web and API security (OWASP Top 10, OAuth/OIDC, JWT, REST/GraphQL) as it relates to mobile back‑ends ~ Strong report writing and the ability to explain technical risk to non‑technical audiences ~ Professional certifications are strongly preferred, especially SANS/GIAC credentials in mobile testing. GIAC Mobile Device Security Analyst (GMOB)
- from SANS SEC575: iOS and Android Application Security Analysis and Penetration Testing. Experience with internal network penetration testing: Experience testing mobile device management (MDM), mobile banking/fintech, or healthcare apps and their regulatory requirements (PCI DSS, HIPAA, PIPEDA) Familiarity with mobile malware analysis or firmware/IoT companion‑app testing Published research, CVEs, open‑source contributions, or talks in the mobile security space