Senior Security Engineer – Application & Mobile Penetration Testing

About the role

We are seeking a Senior Security Engineer to lead comprehensive penetration testing of web, API, Android and iOS applications, drive vulnerability remediation, and strengthen our secure development lifecycle.

Key responsibilities

• Perform manual and automated penetration testing across web, API, Android and iOS platforms, covering OWASP Top 10, API Security Top 10 and Mobile Top 10 / MASVS.
• Conduct advanced testing of authentication, authorization, IDOR/BOLA, business logic, injection, session management, data protection and API security.
• Execute mobile security testing using tools such as MobSF, Frida, Objection, JADX and apktool, including static and dynamic analysis.
• Integrate SAST, DAST and SCA tools into CI/CD pipelines and develop automation scripts in Python, JavaScript or Bash.
• Leverage AI‑augmented testing tools for endpoint discovery, payload generation and security reporting.
• Participate in threat modeling, architecture reviews and secure SDLC activities using STRIDE and PASTA, collaborating with developers and DevOps teams.
• Mentor junior team members and contribute to continuous improvement of testing methodologies.

Required profile

• 3–5 years of hands‑on application security or penetration testing experience covering web, API and mobile.
• Strong analytical, problem‑solving and communication skills, able to convey findings to technical and non‑technical audiences.

Required skills

• Burp Suite Professional, Nmap and common vulnerability scanners.
• Mobile security tools: MobSF, Frida, Objection, JADX/apktool.
• Deep knowledge of REST APIs, OAuth, JWT, HTTP/HTTPS, TLS and authentication/authorization mechanisms.
• Experience with CI/CD, DevSecOps, SAST, DAST and SCA integration.
• Scripting and automation in Python, JavaScript or Bash.
• Familiarity with AI‑assisted security testing tools.