Native Android / iOS Developer

OTPless, Inc.; Bengaluru; On-site; INR 1,500,000 - 3,000,000; Full time

Job summary

OTPless, Inc. is looking for a mobile SDK engineer to own native Android and iOS SDK development, security hardening, and partner integration. You will shape architecture, manage backward compatibility, and optimize size and latency across devices.

You will implement root/jailbreak detection, anti-tampering, and device fingerprinting, and collaborate with security and ML teams. Strong Kotlin/Java or Swift/ObjC skills are required.

Qualifications

• 2–6 years of hands-on native mobile development on Android and/or iOS.
• Experience building and shipping SDKs used by external partners.
• Strong understanding of root/jailbreak detection and anti-tampering.
• Familiarity with device fingerprinting and privacy-conscious signals.
• Knowledge of platform security primitives (Keystore / Keychain / Secure Enclave).

Responsibilities

• Build and maintain native Android and iOS SDKs for partner apps.
• Own SDK architecture, versioning, and backward compatibility.
• Harden devices against root/jailbreak, emulators, and hooking.
• Develop integration docs, sample apps, and support tooling.
• Ensure CI/CD for SDK builds and staged rollouts.
• Provide L2/L3 support for partner integration issues.

Skills

Android development

iOS development

Kotlin

Swift

Objective-C

SDK development

Security fundamentals

RASP concepts

Public API design

CI/CD

Device fingerprinting

Tools

Frida

Xposed

Cydia Substrate

ProGuard/R8

DexGuard

iXGuard

jadx

Hopper

Job description

The core responsibilities for the job include the following:

SDK Engineering:

• Build and maintain native Android (Kotlin/Java) and iOS (Swift/Objective-C) SDKs used by bank, fintech, and startup apps.
• Own SDK architecture, versioning, and backward compatibility across partner and OS versions.
• Optimize SDK size, cold-start latency, and memory footprint.
• Write integration docs, sample apps, and support tooling for partner teams.

Device Security and Anti-Fraud:

• Build and harden root/jailbreak, emulator, debugger, and hooking-framework detection (Frida, Xposed, Cydia Substrate).
• Build device fingerprinting for fraud and risk signals.
• Implement RASP: obfuscation, tamper detection, integrity checks, and anti-repackaging.
• Track emerging bypass techniques and patch proactively.
• Feed device signals into the fraud detection engine, working with the security and ML teams.

Platform and Ecosystem:

• Work fluently across Android (Kotlin, NDK where relevant) and iOS (Swift, Objective-C).
• Integrate biometrics, Android Keystore, iOS Keychain/Secure Enclave, Play Integrity API, and App Attest.
• Define secure SDK-to-server protocols: token exchange, certificate pinning, replay protection.
• Support partner integration, testing, and certification directly.

Quality, Release, and Support:

• Test across a wide matrix of real devices, OS versions, and manufacturers.
• Own crash-free rate, ANR rate, and SDK stability in production.
• Build and maintain CI/CD for SDK builds, testing, and staged rollouts.
• Provide L2/L3 support for partner integration issues.

Requirements:

• 2-6 years of hands‑on native mobile development experience (Android and/or iOS). Strong depth on one platform with working knowledge of the other is fine.
• Proven experience building and shipping SDKs (not just apps) consumed by external partners, with an understanding of versioning, backward compatibility, and public API design.
• Solid understanding of device security fundamentals: root/jailbreak detection, anti‑tampering, code obfuscation.
• Working knowledge of device fingerprinting techniques and privacy‑conscious identity signal generation.
• Familiarity with RASP concepts and implementation: runtime integrity checks, hooking/injection detection.
• Strong grasp of platform security primitives: Android Keystore / Play Integrity API, iOS Keychain / Secure Enclave / App Attest.
• Comfort working across Kotlin/Java (Android) and/or Swift/Objective-C (iOS).
• Experience debugging across a wide range of real devices and OS versions, not just emulators.

Good to Have:

• Experience with obfuscation/protection tooling (ProGuard/R8, DexGuard, iXGuard, or similar).
• Familiarity with the reverse‑engineering tools attackers use (Frida, Xposed, Cydia Substrate, jadx, and Hopper), since understanding offense sharpens defense.
• Experience integrating with banking or fintech apps, or working under RBI/PCI‑DSS‑adjacent constraints.
• NDK/C++ experience on Android, or low‑level iOS security work.
• Experience with certificate pinning, mutual TLS, or other secure‑transport hardening.
• Contribution to a published SDK/library with real external developer adoption.