Security Consultant – Mobile & Web Application Security

Elastify; Toronto; On-site; CAD 120,000 - 180,000; Full time

Job summary

Elastify is seeking a Security Consultant focused on mobile application security to assess iOS and Android apps, identify critical flaws, and guide engineering teams to fix them. This hands-on, client-facing role covers end-to-end testing, including APIs and back‑ends, with a focus on delivering clear, actionable reports.

You will review secure storage, cryptography, authentication, and session handling, and communicate findings to stakeholders while assisting with retesting and knowledge

Qualifications

• 4+ years in offensive security with mobile testing focus.
• Experience assessing iOS and Android apps (native and cross‑platform).
• Knowledge of MASVS/MASTG in real engagements.
• Able to explain risk to non‑technical audiences.

Responsibilities

• Perform penetration tests and security assessments of iOS and Android applications, including APIs and back‑ends.
• Reverse engineer and instrument mobile apps (static and dynamic analysis, runtime hooking, traffic interception).
• Test against MASVS/MASTG.
• Review secure storage, cryptography, authentication, session handling, IPC, and third‑party SDKs.
• Write clear, actionable reports with reproducible steps and remediation guidance.
• Present findings to client engineering, product and executives, and support retesting.
• Contribute to internal tooling and testing methodologies.
• Scope engagements and support pre‑sales as a mobile security SME.

Skills

Mobile security testing

iOS & Android testing

Reverse engineering

API security

Report writing

Client communication

Tooling development

Engagement scoping

Tools

Frida

Objection

Burp Suite

MobSF

jadx

apktool

Hopper

Ghidra

Job description

We are hiring a Security Consultant who lives and breathes mobile application security. You will assess iOS and Android apps for our clients, find the flaws that matter, and help engineering teams fix them for good.

This is a hands‑on, client‑facing consulting role. You will run penetration tests end to end: scoping, testing, reporting, and readout. Mobile is the focus, but the apps you test talk to APIs, back‑ends, and identity systems, so you will touch those too.

What you’ll do

• Perform penetration tests and security assessments of iOS and Android applications, including the APIs and back‑end services they depend on
• Reverse engineer and instrument mobile apps (static and dynamic analysis, runtime hooking, traffic interception, certificate‑pinning and root/jailbreak‑detection bypass)
• Test against the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG)
• Review secure storage, cryptography, authentication, session handling, inter‑process communication, deep links and third‑party SDK usage
• Write clear, actionable reports with reproducible steps, risk ratings and practical remediation guidance
• Present findings to client engineering, product and executive stakeholders and support retesting
• Contribute to internal tooling, testing methodology and knowledge sharing across the consulting team
• Scope engagements and support pre‑sales conversations as a mobile security subject matter expert

What you bring

• 4+ years in offensive security or application security, with at least 1 year focused on mobile application testing
• Deep, demonstrable experience assessing both iOS and Android apps, including native (Swift/Objective‑C, Kotlin/Java) and cross‑platform frameworks (React Native, Flutter, Xamarin)
• Fluency with the mobile testing toolchain: Frida, Objection, Burp Suite, MobSF, jadx, apktool, Hopper or Ghidra, and the iOS/Android debugging and instrumentation stack
• Working knowledge of OWASP MASVS/MASTG and how to apply them in real engagements
• Solid understanding of web and API security (OWASP Top 10, OAuth/OIDC, JWT, REST/GraphQL) as it relates to mobile back‑ends
• Strong report writing and the ability to explain technical risk to non‑technical audiences
• Comfortable working directly with clients and managing your own engagement timelines

Certifications

Professional certifications are strongly preferred, especially SANS/GIAC credentials in mobile testing.

• GIAC Mobile Device Security Analyst (GMOB) - from SANS SEC575: iOS and Android Application Security Analysis and Penetration Testing. This is the credential we value most for this role.
• Other SANS/GIAC offensive certifications are a strong plus: GPEN, GWAPT, GXPN, or GREM
• Also recognized: OSCP, OSWE, CREST CRT/CCT, or the OWASP MAS Advocate designation

Candidates without formal certification but with a strong portfolio of mobile findings, CVEs, bug bounty results, or conference talks are encouraged to apply.

Nice to have

• Experience with internal network penetration testing: Active Directory attack paths, lateral movement, privilege escalation, and tools such as Nmap, BloodHound, Impacket, Responder, and CrackMapExec/NetExec
• Experience testing mobile device management (MDM), mobile banking/fintech, or healthcare apps and their regulatory requirements (PCI DSS, HIPAA, PIPEDA)
• Familiarity with mobile malware analysis or firmware/IoT companion‑app testing
• Published research, CVEs, open‑source contributions, or talks in the mobile security space
• Prior consulting or professional‑services experience managing multiple client engagements