Security Analyst / Ad Fraud Researcher

Pixalate, Inc; Lahore; Remote; PKR 1,800,000 - 3,200,000; Full time

Job summary

Pixalate is hiring a Security Analyst / Ad Fraud Researcher to find, reverse-engineer and expose fraud schemes targeting mobile apps and Connected TV (CTV). You’ll treat ad fraud like malware research: collect samples, analyze behavior, and translate findings into detection logic for IVT/SIVT pipelines.

You’ll join the Threat Research team to collaborate with Data Science, Engineering and Product, publishing threat reports and briefing clients and press as needed.

Qualifications

• 5+ years in threat research, malware analysis or security analysis at a security vendor, SOC or research lab.
• Hands-on malware analysis: sandboxing, static and dynamic analysis, and reading decompiled or obfuscated code.
• Working knowledge of Android internals and app analysis tools (e.g. jadx, apktool, Frida, MobSF, Ghidra).
• Network traffic analysis (Wireshark, mitmproxy, Burp) and spotting automated or anomalous traffic.
• SQL and a scripting language such as Python for analyzing large datasets.
• Track record of turning research into product intelligence: signatures, blocklists, classifiers or rules.
• Strong writing and presenting skills, with published blogs, reports or talks for technical and business audiences.

Responsibilities

• Hunt mobile ad fraud: analyze Android and iOS apps (APKs/IPAs) for hidden ads, ad stacking, click injection, SDK spoofing, background ad loading and malicious ad SDKs
• Investigate CTV fraud: uncover SSAI spoofing, device and app-bundle spoofing, emulator/server-side bot traffic, and fake CTV inventory sold programmatically
• Reverse-engineer samples: use static and dynamic analysis to understand how fraudulent apps, SDKs and botnets behave, and document their traffic signatures
• Turn research into detection: write rules, signatures and indicators for Pixalate’s IVT pipelines, and validate them against impression-level data at scale
• Map the supply chain: trace fraud through app-ads.txt, sellers.json, SupplyChain objects and bid-stream data to identify the resellers and publishers behind it
• Track threat actors: follow fraud operations over time, link campaigns to infrastructure, and monitor underground forums and app stores for new schemes
• Publish and present: write blog posts, threat reports and research briefs; speak at industry events, webinars, and with press and clients
• Support customers: help Customer Success and Sales explain findings to advertisers, DSPs, SSPs and platforms, and assist with escalated investigations

Skills

Threat research

Malware analysis

Android internals

Network traffic analysis

Python

SQL

Product intelligence

Communication skills

Tools

jadx

apktool

Frida

MobSF

Ghidra

Wireshark

mitmproxy

Burp

Job description

Security Analyst / Ad Fraud Researcher

Employment Type: Full-Time
Location: Remote, Pakistan (Lahore)

About the Role

Pixalate is hiring a Security Analyst / Ad Fraud Researcher to find, reverse-engineer and expose fraud schemes targeting mobile apps and Connected TV (CTV). You’ll treat ad fraud the way a threat researcher treats malware: collect samples, take them apart, turn what you learn into detection logic, and tell the market what you found. You’ll sit on the Threat Research team, working with Data Science, Engineering and Product. Your findings feed Pixalate’s MRC-accredited invalid traffic (IVT) detection and its public research on mobile and CTV supply-chain risk

Key Research Areas & Responsibilities

• Hunt mobile ad fraud: analyze Android and iOS apps (APKs/IPAs) for hidden ads, ad stacking, click injection, SDK spoofing, background ad loading and malicious ad SDKs
• Investigate CTV fraud: uncover SSAI spoofing, device and app-bundle spoofing, emulator/server-side bot traffic, and fake CTV inventory sold programmatically
• Reverse-engineer samples: use static and dynamic analysis to understand how fraudulent apps, SDKs and botnets behave, and document their traffic signatures
• Turn research into detection: write rules, signatures and indicators for Pixalate’s GIVT and SIVT pipelines, and validate them against impression-level data at scale
• Map the supply chain: trace fraud through app-ads.txt, sellers.json, SupplyChain objects and bid-stream data to identify the resellers and publishers behind it
• Track threat actors: follow fraud operations over time, link campaigns to infrastructure, and monitor underground forums and app stores for new schemes
• Publish and present: write blog posts, threat reports and research briefs; speak at industry events, webinars, and with press and clients
• Support customers: help Customer Success and Sales explain findings to advertisers, DSPs, SSPs and platforms, and assist with escalated investigations

Required Qualifications

• 5+ years in threat research, malware analysis or security analysis at a security vendor, SOC or research lab
• Hands-on malware analysis: sandboxing, static and dynamic analysis, and reading decompiled or obfuscated code
• Working knowledge of Android internals and app analysis tools (e.g. jadx, apktool, Frida, MobSF, Ghidra)
• Network traffic analysis (Wireshark, mitmproxy, Burp) and spotting automated or anomalous traffic
• SQL and a scripting language such as Python for analyzing large datasets
• Track record of turning research into product intelligence: signatures, blocklists, classifiers or rules
• Strong writing and presenting skills, with published blogs, reports or talks for technical and business audiences

Preferred Qualifications

• Ad tech experience: OpenRTB, VAST/VPAID, SSAI, DSPs and SSPs
• Familiarity with MRC IVT Guidelines, TAG and IAB Tech Lab standards (app-ads.txt, sellers.json, SupplyChain object)
• CTV platform experience: Roku, Fire TV, Android TV, Samsung Tizen or LG webOS
• Background in ransomware, botnet, phishing or cryptojacking research, and how that infrastructure is reused for ad fraud
• Threat-intel tooling: YARA, VirusTotal, passive DNS and OSINT methods
• Public research profile: named threat reports, recurring webinars or media commentary

About us

Pixalate is an online trust and safety platform that protects businesses, consumers and children from deceptive, fraudulent and non-compliant mobile, CTV apps and websites.

Our software and data have been used to unearth multiple high profile criminal and illegal surveillance cases including:

• Gizmodo: An iCloud Feature Is Enabling a $65 Million Scam, New Research Says
• Adweek: A 7-Figure Ad Fraud Scheme Running on Roku Underlines Murkiness of CTV
• Washington Post: Your kids’ apps are spying on them
• Pro Publica: Porn, Piracy, Fraud: What Lurks Inside Google’s Black Box Ad Empire
• ABC7 News: The State of Children's Privacy Online
• NBC News: How many apps are tracking your children

Our team of lawyers, data scientists, engineers, economists and researchers span globally with presence in California, New York, Washington DC , London and Singapore.