Mobile Application Senior Security Engineer

Klarna; Greater London; Hybrid; GBP 110,000 - 150,000; Full time

Job summary

Klarna is hiring a Mobile Application Senior Security Engineer in London to own offensive security for Klarna’s mobile surface. You will perform penetration tests, red-team exercises, and binary reversals to expose sandboxing and permission weaknesses before attackers do.

You’ll work with engineers to turn findings into concrete fixes while aligning with MASVS/MASTG guidelines. The role emphasizes collaboration with multiple teams, hands-on testing across iOS and Android, and delivery of

Qualifications

• Hands-on offensive mobile security work on iOS/Android.
• Knowledge of mobile internals: sandboxing and permissions.

Responsibilities

• Run offensive security assessments against Klarna's iOS and Android apps.
• Reverse‑engineer app binaries to surface weaknesses before attackers.
• Test apps against MASVS/MASTG and translate results into fixes with engineering teams.
• Evaluate and stress-test app-hardening and RASP protections with teams.
• Document findings so engineers can act on them.

Skills

Offensive mobile security

Mobile security tooling

OWASP MASVS/MASTG

Bug bounty / security research

Production mobile code shipping

CVEs / talks

Tools

Frida

Objection

MobSF

jadx/apktool

Ghidra/Hopper

Burp Suite

mitmproxy

Job description

Klarna, briefly At Klarna, we're building an everyday finance network, helping over 120 million consumers across 26 countries save time and money, and worry less about their finances. Working here means taking on problems most companies never get to solve, and being hands‑on enough that the interesting part of the work lands with you, not someone else - you'll build with AI, not watch it happen. This is the stretch zone. Come find out what you're capable of.

About the role

Every payment, login, and stored card in Klarna's iOS and Android apps depends on mobile‑specific protections holding up - sandboxing, permission models, anti‑tampering - and someone has to attack them before someone else does. That's you. You'll work as an offensive security specialist focused entirely on Klarna's mobile surface. You'll run penetration tests and red‑team exercises against the apps, reverse‑engineer builds to find what static review misses, and use the OWASP Mobile Application Security Verification Standard (MASVS) and Testing Guide (MASTG) as your working framework rather than a checklist you fill in after the fact. You'll work closely with the engineering teams who build and harden the apps, turning what you find into fixes that ship, not just findings that sit in a report.

What you'll do

• You'll run offensive security assessments - penetration tests, red‑team exercises, and vulnerability research - against Klarna's iOS and Android apps.
• You'll reverse‑engineer app binaries to surface sandboxing, permission, and platform‑security weaknesses before an outside attacker finds them.
• You'll test Klarna's mobile apps against the OWASP MASVS and MASTG, and use the results to drive concrete fixes with engineering teams.
• You'll evaluate and stress‑test app‑hardening and RASP protections, working directly with the teams that build and maintain them.
• You'll write up what you find in a way engineers can act on immediately, and follow through until it's actually fixed.

Who you are

• You've done hands‑on offensive mobile security work - professional pentesting, red teaming, bug bounty, or dedicated security research - against iOS, Android, or both.
• You understand mobile internals: app sandboxing, permission models, and the security architectures of iOS and Android.
• You're fluent with mobile security tooling such as Frida, Objection, MobSF, jadx or apktool, Ghidra or Hopper, Burp Suite, and mitmproxy.
• You work from the OWASP MASVS and MASTG as your reference framework, not as an afterthought.
• Experience securing fintech, payments, or banking apps.
• Exposure to app‑hardening and RASP solutions, from both the attacker's and defender's side.
• Published CVEs, research, conference talks, or a track record in mobile bug bounty programs.
• Experience shipping production mobile code or similar.
• Familiarity with mobile app attestation (Play Integrity, App Attest) and device‑binding schemes.

Things you should know before applying

• Working together: we value co‑located teams; most teams currently meet in the office 2-3 days per week, and this varies by team and can change over time.
• Non‑obvious backgrounds are welcome. Diversity of skills, perspectives and backgrounds is how we create, innovate, and disrupt like no other.
• Final compensation will be based on the candidate's qualifications, skills, and experience.
• Please include a CV in English.
• Concrete beats comprehensive - what you built, what it did, what it cost.
• Curious to learn more about Klarna and what it's like to work here? Explore our career site!

Mobile Application Senior Security Engineer London - United Kingdom