Security Consultant - Mobile & Web Application Security

We are hiring a Security Consultant who lives and breathes mobile application security. You will assess iOS and Android apps for our clients, find the flaws that matter, and help engineering teams fix them for good.
This is a hands‑on, client‑facing consulting role. You will run penetration tests end to end: scoping, testing, reporting, and readout. Mobile is the focus, but the apps you test talk to APIs, back‑ends, and identity systems, so you will touch those too.
What you’ll do
Perform penetration tests and security assessments of iOS and Android applications, including the APIs and back‑end services they depend on
Reverse engineer and instrument mobile apps (static and dynamic analysis, runtime hooking, traffic interception, certificate‑pinning and root/jailbreak‑detection bypass)
Test against the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG)
Review secure storage, cryptography, authentication, session handling, inter‑process communication, deep links and third‑party SDK usage
Write clear, actionable reports with reproducible steps, risk ratings and practical remediation guidance
Present findings to client engineering, product and executive stakeholders and support retesting
Contribute to internal tooling, testing methodology and knowledge sharing across the consulting team
Scope engagements and support pre‑sales conversations as a mobile security subject matter expert
What you bring
4+ years in offensive security or application security, with at least 1 year focused on mobile application testing
Deep, demonstrable experience assessing both iOS and Android apps, including native (Swift/Objective‑C, Kotlin/Java) and cross‑platform frameworks (React Native, Flutter, Xamarin)
Fluency with the mobile testing toolchain: Frida, Objection, Burp Suite, MobSF, jadx, apktool, Hopper or Ghidra, and the iOS/Android debugging and instrumentation stack
Working knowledge of OWASP MASVS/MASTG and how to apply them in real engagements
Solid understanding of web and API security (OWASP Top 10, OAuth/OIDC, JWT, REST/GraphQL) as it relates to mobile back‑ends
Strong report writing and the ability to explain technical risk to non‑technical audiences
Comfortable working directly with clients and managing your own engagement timelines
Certifications
Professional certifications are strongly preferred, especially SANS/GIAC credentials in mobile testing.
GIAC Mobile Device Security Analyst (GMOB) - from SANS SEC575: iOS and Android Application Security Analysis and Penetration Testing. This is the credential we value most for this role.
Other SANS/GIAC offensive certifications are a strong plus: GPEN, GWAPT, GXPN, or GREM
Also recognized: OSCP, OSWE, CREST CRT/CCT, or the OWASP MAS Advocate designation
Candidates without formal certification but with a strong portfolio of mobile findings, CVEs, bug bounty results, or conference talks are encouraged to apply.
Nice to have
Experience with internal network penetration testing: Active Directory attack paths, lateral movement, privilege escalation, and tools such as Nmap, BloodHound, Impacket, Responder, and CrackMapExec/NetExec
Experience testing mobile device management (MDM), mobile banking/fintech, or healthcare apps and their regulatory requirements (PCI DSS, HIPAA, PIPEDA)
Familiarity with mobile malware analysis or firmware/IoT companion‑app testing
Published research, CVEs, open‑source contributions, or talks in the mobile security space
Prior consulting or professional‑services experience managing multiple client engagements
#J-18808-Ljbffr