Mobile App Payments & RED Teaming Engineer

We are seeking a highly skilled Mobile App Payments and Red Teaming Engineer to strengthen the security posture of our mobile payment ecosystem through advanced offensive security testing and adversary simulation exercises. The role will focus on identifying vulnerabilities within mobile applications, payment systems, APIs, backend infrastructure, and associated digital assets through penetration testing and realistic red-team engagements. The ideal candidate should possess strong expertise in mobile application security, payment security standards, adversary simulation techniques, and offensive security methodologies.

The candidate will have responsibilities across the following functions:

Mobile Application Security Assessment:

• Perform penetration testing on Android and iOS mobile applications.
• Assess the security posture of mobile payment applications and digital wallets.
• Conduct static and dynamic application security testing (SAST/DAST).
• Perform API security testing for payment interfaces and backend services.
• Analyse authentication mechanisms including OAuth, JWT, SSO, biometrics, and MFA implementations.
• Identify vulnerabilities such as insecure data storage, broken authentication, improper session management, reverse engineering risks, code tampering, SSL pinning bypass issues, runtime manipulation risks, and root/jailbreak detection bypasses.

Payment Security Assessment:

• Conduct security assessments on payment gateways, UPI integrations, digital wallets, card payment ecosystems, tokenisation mechanisms, and QR payment implementations.
• Validate compliance with PCI-DSS, PCI Secure Software Standards, OWASP MASVS, OWASP Mobile Top 10 and payment industry security controls.

Red Team Operations:

• Design and execute realistic adversary simulation exercises.
• Conduct red-team assessments across mobile, cloud, API, and payment environments.
• Emulate attacker tactics, techniques, and procedures (TTPs).
• Perform phishing simulation exercises, social engineering assessments, credential attack simulations, lateral movement testing, privilege escalation exercises, and persistence techniques validation.
• Map findings against the MITRE ATT& CK framework.

Security Research and Threat Intelligence:

• Research emerging attack vectors impacting mobile payment ecosystems.
• Analyse fraud trends and evolving threats targeting digital payment platforms.
• Develop proof-of-concept exploits for identified vulnerabilities.
• Recommend mitigation strategies and security improvements.

The core requirements for the job include the following:

Mobile Security:

• Android and iOS architecture knowledge.
• Reverse engineering tools: APKTool, Jadx, Ghidra, IDA Pro.
• Dynamic analysis tools: Frida, Objection, Burp Suite, MobSF, Charles Proxy.

Offensive Security:

• Web and API security testing.
• Network security assessment.
• Red Team methodologies.
• MITRE ATT& CK framework.
• Adversary emulation.
• Programming/Scripting: Experience in one or more: Python, Java, JavaScript, Bash, PowerShell.

Security Knowledge:

• OWASP Top 10
• OWASP Mobile Top 10
• OWASP MASVS
• PCI DSS
• Secure SDLC

Preferred Certifications and Education:

• OSCP (Offensive Security Certified Professional).
• Bachelor's or Master's degree in Computer Science, Information Security, Cyber Security, Engineering, or equivalent practical experience.

Desired Attributes:

• Strong analytical and problem-solving skills.
• Ability to think like an attacker.
• Strong communication and reporting skills.
• Ability to explain technical findings to executive stakeholders.
• Experience working in Agile and DevSecOps environments.
• Strong documentation and presentation skills.

Success Metrics:

• Critical vulnerabilities identified and remediated.
• Improvement in mobile payment application security posture.
• Red-team exercise effectiveness and coverage.
• Reduction in recurring security findings.
• Security control maturity enhancement.

Skills

API, Android, Burp, Frida, Ghidra, Jadx, MITRE, MobSF, OSCP, OWASP MASVS, PCI DSS, iOS, mobile, payment