Mobile Appsec - SME

Key Responsibilities

• Perform security testing of Android and iOS mobile applications used in digital payment ecosystems
• Conduct manual and automated mobile security testing aligned with:
• OWASP Mobile Top 10
• OWASP MASVS & MSTG
• Identify vulnerabilities related to:
• Insecure data storage
• Weak cryptography
• Insecure communication
• Authentication & authorization flaws
• Business logic issues in payment flows
• Perform runtime instrumentation and dynamic analysis using:
• Frida, Objection, Xposed
• Reverse engineer mobile applications using:
• APKTool, JADX (Android)
• Basic iOS reverse engineering tools (class-dump, Hopper, Ghidra)
• Intercept and analyze mobile traffic using:
• Burp Suite (Mobile Assistant preferred)
• mitmproxy / Charles Proxy
• Test mobile backend APIs supporting payment workflows using:
• Burp Suite, Postman
• Validate security of payment features, including:
• UPI, wallets, cards, tokenization
• OTP, MFA, session management
• Prepare high-quality vulnerability reports with:
• Risk assessment
• Proof of Concept (PoC)
• Clear remediation guidance
• Support retesting and vulnerability closure
• Work closely with development and product teams to explain findings and fixes

R&D Mindset & Innovation (Mandatory)

• Strong research-driven mindset to explore vulnerabilities beyond standard checklists
• Ability to research and validate new attack vectors in mobile and FinTech environments
• Regularly analyze:
• New Android/iOS versions and security changes
• Advanced bypass techniques (SSL pinning, root/jailbreak detection)
• Develop custom test cases for complex payment and business logic scenarios
• Contribute to:
• Internal tools, scripts, and testing methodologies
• Knowledge sharing and security best practices
• Ability to independently validate false positives and negatives

Scripting & Automation Skills (Mandatory)

• Hands-on scripting experience in one or more of the following:
• Python - automation, PoC development, API testing
• JavaScript - Frida hooks and runtime manipulation
• Bash - automation and tooling
• Ability to:
• Write and modify custom Frida scripts
• Automate repetitive testing and analysis tasks
• Customize open-source tools for specific app behaviors
• Strong understanding of secure coding flaws through runtime and code-level analysis

Mandatory Skills & Experience

• 3-4 years of experience in mobile application security testing
• Strong understanding of Android and iOS security architectures
• Hands-on experience with:
• MobSF, AndroBugs, QARK
• Frida, Objection
• Burp Suite
• Experience testing BFSI / FinTech / Digital Payment applications
• Strong knowledge of:
• OWASP Mobile Top 10
• OWASP API Top 10 (supporting APIs)

Good to Have

• Exposure to PCI-DSS, RBI, or CERT-In security requirements
• Experience with CI/CD integration for mobile security testing
• Basic understanding of cloud and backend security supporting mobile apps
• iOS security testing experience is a strong plus