Mobile Appsec - SME

TalaKunchi Networks Pvt Ltd; Mumbai; On-site; INR 800,000 - 1,200,000; Full time

Job summary

A leading mobile security company in Mumbai seeks an experienced security tester for Android and iOS applications. The ideal candidate will perform security testing in digital payment ecosystems and identify vulnerabilities in payment workflows. Candidates should have 3-4 years of experience, strong scripting skills, and a deep understanding of security architectures. Familiarity with tools like Burp Suite and MobSF is essential. A collaborative environment fosters innovation and knowledge sharing.

Qualifications

• Strong understanding of Android and iOS security architectures.
• Experience testing BFSI/FinTech/Digital Payment applications.
• Knowledge of OWASP Mobile Top 10 and API Top 10.

Responsibilities

• Perform security testing for Android and iOS apps.
• Identify vulnerabilities in payment flows and report them.
• Conduct manual and automated security testing.
• Support retesting and assist development teams with fixes.

Skills

Mobile application security testing

Scripting in Python

JavaScript for runtime manipulation

Bash scripting

Frida hooks

Education

3-4 years of experience in mobile security

Tools

MobSF

AndroBugs

QARK

Burp Suite

mitmproxy

Charles Proxy

Job description

Key Responsibilities

• Perform security testing of Android and iOS mobile applications used in digital payment ecosystems
• Conduct manual and automated mobile security testing aligned with:
• OWASP MASVS & MSTG
• Identify vulnerabilities related to:
• Weak cryptography
• Insecure communication
• Business logic issues in payment flows
• Perform runtime instrumentation and dynamic analysis using:
• Frida, Objection, Xposed
• Reverse engineer mobile applications using:
• Basic iOS reverse engineering tools (class-dump, Hopper, Ghidra)
• Intercept and analyze mobile traffic using:
• mitmproxy / Charles Proxy
• Test mobile backend APIs supporting payment workflows using:
• Burp Suite, Postman
• Validate security of payment features, including:
• UPI, wallets, cards, tokenization
• Prepare high-quality vulnerability reports with:
• Proof of Concept (PoC)
• Support retesting and vulnerability closure
• Work closely with development and product teams to explain findings and fixes
• Strong research-driven mindset to explore vulnerabilities beyond standard checklists
• Ability to research and validate new attack vectors in mobile and FinTech environments
• Regularly analyze:
• New Android/iOS versions and security changes
• Advanced bypass techniques (SSL pinning, root/jailbreak detection)
• Develop custom test cases for complex payment and business logic scenarios
• Contribute to:
• Internal tools, scripts, and testing methodologies
• Knowledge sharing and security best practices
• Ability to independently validate false positives and negatives

R&D Mindset & Innovation (Mandatory)

• Strong research-driven mindset to explore vulnerabilities beyond standard checklists
• Ability to research and validate new attack vectors in mobile and FinTech environments
• Regularly analyze:
• New Android/iOS versions and security changes
• Advanced bypass techniques (SSL pinning, root/jailbreak detection)
• Develop custom test cases for complex payment and business logic scenarios
• Contribute to:
• Internal tools, scripts, and testing methodologies
• Knowledge sharing and security best practices
• Ability to independently validate false positives and negatives

Scripting & Automation Skills (Mandatory)

• Hands-on scripting experience in one or more of the following:
• Python – automation, PoC development, API testing
• JavaScript – Frida hooks and runtime manipulation
• Bash – automation and tooling
• Ability to:
• Write and modify custom Frida scripts
• Automate repetitive testing and analysis tasks
• Customize open-source tools for specific app behaviors
• Strong understanding of secure coding flaws through runtime and code-level analysis

Mandatory Skills & Experience

• 3–4 years of experience in mobile application security testing
• Strong understanding of Android and iOS security architectures
• Hands-on experience with:
• MobSF, AndroBugs, QARK
• Frida, Objection
• Burp Suite
• Experience testing BFSI / FinTech / Digital Payment applications
• Strong knowledge of:
• OWASP Mobile Top 10
• OWASP API Top 10 (supporting APIs)

Good to Have

• Exposure to PCI-DSS, RBI, or CERT-In security requirements
• Experience with CI/CD integration for mobile security testing
• Basic understanding of cloud and backend security supporting mobile apps
• iOS security testing experience is a strong plus