Apply with hirly
Mobile Appsec - SME
Talakunchi Networks · Andheri, India
Upload your resume to see how well you match this job — free, in seconds, no account needed.
Your resume is used only to score it against this job. If you don't create an account, it is deleted within 24 hours.
Key Responsibilities
- Perform security testing of Android and iOS mobile applications used in digital payment ecosystems
- Conduct manual and automated mobile security testing aligned with:
- OWASP Mobile Top 10 •
Owasp Masvs
& MSTG
- Identify vulnerabilities related to:
- Insecure data storage
- Weak cryptography
- Insecure communication
- Authentication & authorization flaws
- Business logic issues in payment flows
- Perform runtime instrumentation and dynamic analysis using:
- Frida, Objection, Xposed
- Reverse engineer mobile applications using:
- APKTool, JADX (Android)
- Basic iOS reverse engineering tools (class-dump, Hopper, Ghidra)
- Intercept and analyze mobile traffic using:
- Burp Suite (Mobile Assistant preferred)
- mitmproxy / Charles Proxy
- Test mobile backend APIs supporting payment workflows using:
- Burp Suite, Postman
- Validate security of payment features , including:
- UPI, wallets, cards, tokenization
- OTP, MFA, session management
- Prepare high-quality vulnerability reports with:
- Risk assessment
- Proof of Concept (PoC)
- Clear remediation guidance
- Support retesting and vulnerability closure
- Work closely with development and product teams to explain findings and fixes R&D Mindset & Innovation (Mandatory)
- Strong research-driven mindset to explore vulnerabilities beyond standard checklists
- Ability to research and validate new attack vectors in mobile and FinTech environments
- Regularly analyze:
- New Android/iOS versions and security changes
- Advanced bypass techniques (SSL pinning, root/jailbreak detection)
- Develop custom test cases for complex payment and business logic scenarios
- Contribute to:
- Internal tools, scripts, and testing methodologies
- Knowledge sharing and security best practices
- Ability to independently validate false positives and negatives Scripting & Automation Skills (Mandatory)
- Hands-on scripting experience in one or more of the following:
- Python – automation, PoC development, API testing
- JavaScript – Frida hooks and runtime manipulation
- Bash – automation and tooling
- Ability to:
- Write and modify custom Frida scripts
- Automate repetitive testing and analysis tasks
- Customize open-source tools for specific app behaviors
- Strong understanding of secure coding flaws through runtime and code-level analysis Mandatory Skills & Experience
- 3–4 years of experience in mobile application security testing
- Strong understanding of Android and iOS security architectures
- Hands-on experience with:
- MobSF, AndroBugs, QARK
- Frida, Objection
- Burp Suite
- Experience testing BFSI / FinTech / Digital Payment applications
- Strong knowledge of:
- OWASP Mobile Top 10 •
Owasp API
Top 10 (supporting APIs) Good to Have
- Exposure to PCI-DSS , RBI , or CERT-In security requirements
- Experience with CI/CD integration for mobile security testing
- Basic understanding of cloud and backend security supporting mobile apps
- iOS security testing experience is a strong plus