Mobile Appsec - SME

Key Responsibilities Perform security testing of Android and iOS mobile applications used in digital payment ecosystems Conduct manual and automated mobile security testing aligned with: OWASP Mobile Top 10 OWASP MASVS & MSTG Identify vulnerabilities related to: Insecure data storage Weak cryptography Insecure communication Authentication & authorization flaws Business logic issues in payment flows Perform runtime instrumentation and dynamic analysis using: Frida, Objection, Xposed Reverse engineer mobile applications using: APKTool, JADX (Android) Basic iOS reverse engineering tools (class-dump, Hopper, Ghidra) Intercept and analyze mobile traffic using: Burp Suite (Mobile Assistant preferred) mitmproxy / Charles Proxy Test mobile backend APIs supporting payment workflows using: Burp Suite, Postman Validate security of payment features , including: UPI, wallets, cards, tokenization OTP, MFA, session management Prepare high-quality vulnerability reports with: Risk assessment Proof of Concept (PoC) Clear remediation guidance Support retesting and vulnerability closure Work closely with development and product teams to explain findings and fixes R&D Mindset & Innovation (Mandatory) Strong research-driven mindset to explore vulnerabilities beyond standard checklists Ability to research and validate new attack vectors in mobile and FinTech environments Regularly analyze: New Android/iOS versions and security changes Advanced bypass techniques (SSL pinning, root/jailbreak detection) Develop custom test cases for complex payment and business logic scenarios Contribute to: Internal tools, scripts, and testing methodologies Knowledge sharing and security best practices Ability to independently validate false positives and negatives Scripting & Automation Skills (Mandatory) Hands-on scripting experience in one or more of the following: Python – automation, PoC development, API testing JavaScript – Frida hooks and runtime manipulation Bash – automation and tooling Ability to: Write and modify custom Frida scripts Automate repetitive testing and analysis tasks Customize open-source tools for specific app behaviors Strong understanding of secure coding flaws through runtime and code-level analysis Mandatory Skills & Experience 3–4 years of experience in mobile application security testing Strong understanding of Android and iOS security architectures Hands-on experience with: MobSF, AndroBugs, QARK Frida, Objection Burp Suite Experience testing BFSI / FinTech / Digital Payment applications Strong knowledge of: OWASP Mobile Top 10 OWASP API Top 10 (supporting APIs) Good to Have Exposure to PCI-DSS , RBI , or CERT-In security requirements Experience with CI/CD integration for mobile security testing Basic understanding of cloud and backend security supporting mobile apps iOS security testing experience is a strong plus