Mobile Security Engineer

Confidential; Bengaluru Urban; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

Confidential is seeking an experienced Mobile Security Engineer to design, implement, and strengthen security for Android apps and MDM environments. You will focus on cryptography, secure communications, device identity, PKI, authentication, data protection, and app hardening.

Responsibilities include securing Android components, implementing tamper detection, cert pinning, and secure key management, while collaborating across Android, backend, DevOps, QA, and security teams.

Qualifications

• 8+ years in mobile security, Android security, application security or related fields.
• Strong hands-on experience with Android security architecture and cryptography.
• Deep knowledge of PKI, TLS, and secure key management.
• Experience with Android Enterprise/MDM environments and attestation.

Responsibilities

• Design and implement security mechanisms for Android apps and MDM.
• Apply cryptographic techniques for encryption, signatures, and key exchange.
• Design and maintain PKI and certificate lifecycle management.
• Implement secure device-to-server communications using TLS and mTLS.
• Work with Android Keystore, KeyMint, StrongBox, and hardware-backed keys.
• Protect sensitive data and manage device information securely.
• Secure Android components, IPC, permissions, and exported entities.
• Implement app hardening including tamper detection and certificate pinning.
• Oversee MDM enrollment, provisioning, and device lifecycle security.
• Conduct security reviews, threat modelling, and support pentesting.

Skills

Mobile security

Android security

Application security

Cryptography

PKI / X.509

TLS / mTLS

Android Keystore

Security reviews

Java / Kotlin

Backend collaboration

Education

Bachelor's or Master's in CS / Cybersecurity

Tools

MobSF

Frida

Burp Suite

JADX

Ghidra

ADB

HSMs

Job description

We are looking for an experienced Mobile Security Engineer to design, implement, and strengthen security mechanisms for enterprise Android applications and mobile device management (MDM) environments. The role will focus on Android application security, cryptography, secure communications, device identity, PKI, authentication, data protection, and application hardening.

Key Responsibilities

• Design and implement security mechanisms for Android applications and MDM environments.
• Apply cryptographic techniques for encryption, digital signatures, key exchange, hashing, and secure key management.
• Design and maintain PKI and certificate lifecycle management, including certificate issuance, renewal, rotation, and revocation.
• Implement secure device-to-server communication using TLS, mutual TLS, certificates, and secure authentication.
• Work with Android Keystore, KeyMint, StrongBox, hardware-backed keys, and Key Attestation.
• Secure sensitive data, credentials, tokens, encryption keys, and device information.
• Secure Android application components, IPC/Binder, permissions, Services, Broadcast Receivers, Content Providers, and exported components.
• Implement application hardening, including tamper detection, anti-debugging, certificate pinning, obfuscation, and secure configuration.
• Secure MDM device enrollment, provisioning, registration, authentication, and device lifecycle processes.
• Conduct security reviews, threat modelling, vulnerability assessments, and penetration-testing support.
• Review APIs and communication mechanisms between Android clients, MDM platforms, and backend services.
• Identify and remediate mobile application and device-security vulnerabilities.
• Work closely with Android, backend, DevOps, QA, and security teams to implement secure development practices.
• Define security standards and guidelines for Android and MDM development.

Required Skills

• 8+ years of experience in mobile security, Android security, application security, cybersecurity, or related fields.
• Strong hands-on experience with Android application security and Android security architecture.
• Strong understanding of cryptography, including AES, RSA, ECC/ECDSA/ECDH, SHA-2/SHA-3, HMAC, digital signatures, and key management.
• Strong knowledge of PKI, X.509 certificates, certificate chains, CRL/OCSP, TLS, and mutual TLS.
• Hands-on experience with Android Keystore / KeyMint / StrongBox / Key Attestation.
• Experience with Android Enterprise, Device Owner, Profile Owner, Work Profile, or MDM/UEM/EMM platforms.
• Strong understanding of Android permissions, IPC/Binder, Services, Broadcast Receivers, Content Providers, and application components.
• Experience with mobile application hardening, reverse engineering, vulnerability assessment, or penetration testing.
• Good knowledge of secure boot, Verified Boot, TEE, and hardware-backed security.
• Experience with Java/Kotlin and Android SDK.

Preferred Skills:

• Experience with OWASP MASVS / MSTG.
• Experience with MobSF, Frida, Burp Suite, JADX, Ghidra, or ADB.
• Experience with HSMs or hardware security modules.
• Knowledge of FIPS 140-3 or Common Criteria.
• C/C++ and native Android security experience.
• Experience securing APIs and cloud-based services.

Education

Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, or a related field.