Security Engineer (iOs, Android)

Avenue Code; Portugal; Presencial; EUR 45 000 - 65 000; Tempo integral

Resumo da oferta

Avenue Code is seeking a security engineering expert to lead gap analyses and remediation across iOS, Android, and Web capture layers for certification readiness. You will map controls to CEN/TS 18099 and ETSI TS 119 461, design attestation patterns, and guide SDK teams.

Responsibilities include conducting security reviews, advising on PR level changes, and simulating adversarial injections with Frida and similar tools to ensure robust remediation and privacy compliance.

Qualificações

• Deep background in mobile and web security, anti-fraud or biometric defenses.
• Familiar with CEN/TS 18099 or ETSI TS 119 461 standards preferred.
• Experience with dynamic instrumentation and anti-tampering controls.

Responsabilidades

• Perform control-by-control security reviews against CEN/TS 18099 and ETSI TS 119 461 for iOS, Android, and Web capture pipelines.
• Design non-spoofable attestation patterns and frame integrity chains.
• Define anti-fraud strategies including browser fingerprinting and headless detection.
• Translate findings into engineering specs and assist in code reviews.
• Simulate injection attacks (Frida, virtual camera drivers) to validate remediation.

Conhecimentos

Mobile security

Web security

Security standards

Android security

iOS security

Fraud tooling

Ferramentas

Frida

WebGL detection

Attestation tooling

Descrição da oferta de emprego

About The Opportunity

Responsible for leading the security gap analysis, threat modeling, and remediation architecture across Mitek’s iOS, Android, and Web capture layers to achieve CEN/TS 18099 certification readiness. This engineer (or specialized group covering iOS, Android, and Web) will evaluate current signal collection against modern injection attacks (unnamed virtual camera drivers, OS-level hooks, frame injection), map existing controls to ETSI TS 119 461 / eIDAS 2.0 standards, and define technical remediation specifications. They will guide SDK implementation developers, conduct security code reviews, and simulate dynamic injection attacks (Frida, virtual camera drivers) to validate that closed gaps meet certification-grade rigor.

Responsibilities

• Standards Mapping & Gap Analysis: Perform control-by-control security reviews against CEN/TS 18099 and ETSI TS 119 461 requirements across iOS, Android, and Web capture pipelines.
• Architecture & Signal Specification: Design non-spoofable hardware attestation patterns (Android Keystore / iOS Secure Enclave), secure frame chain-of-trust mechanisms, and temporal cross-frame sensor correlation protocols.
• Web Anti-Fraud Strategy: Define browser fingerprinting, anti-automation (Puppeteer/Playwright detection), and hardware/WebGL probing mechanisms to identify virtual webcams while remaining privacy-compliant.
• Developer Guidance & PR Reviews: Translate security findings into precise engineering specs for Android, iOS, and Web developers, assisting in code reviews and pull-request security evaluations.
• Adversarial Validation: Simulate dynamic injection attacks (unnamed virtual camera drivers, OS-level hooks, Frida/Xposed dynamic instrumentation) to validate that remediation measures close identified vulnerabilities without driving up false rejection rates.

SOW Requirement Coverage

• SOW Requirements 1.1 - 1.4 (Project 1 Discovery): Delivers the control-by-control CEN/TS 18099 gap analysis, root-cause assessment of false rejections/signal staleness, candidate signal evaluation across iOS/Android/Web, and the finalized Project 2 remediation roadmap.
• SOW Requirements 2.1 - 2.6 (Architecture & Guidance): Architecturally defines implementation specifications for Android Keystore / iOS Secure Enclave attestation, frame integrity chains, cross-frame sensor correlation, browser fingerprint expansion, and C++ check consolidation.

Risk Mitigation

• Identifies design flaws early and guarantees security controls meet third‑party evaluation lab criteria prior to code freeze, mitigating certification audit failure.

Required Qualifications

• Domain Expertise: Deep background in mobile and web security, anti‑fraud, or biometric liveness defenses. Direct familiarity with CEN/TS 18099, ISO/IEC 30107, or ETSI TS 119 461 standards is strongly preferred.
• Multi‑Platform Security Knowledge:
• Android: Hardware‑Backed Keystore, KeyAttestation, Play Integrity, NDK anti‑tampering, and anti‑Frida controls.
• iOS: Secure Enclave, DCAppAttestService, DeviceCheck, AVFoundation security, and jailbreak detection.
• Web: Client‑side browser fingerprinting (Canvas, WebGL, AudioContext), WebAssembly, and headless automation detection.
• Offensive Security: Proven experience in dynamic instrumentation analysis, memory hooking, and virtual camera injection tools.

Nice To Have Skills

Avenue Code reinforces its commitment to privacy and to all the principles guaranteed by the most accurate global data protection laws, such as GDPR, LGPD, CCPA and CPRA. The Candidate data shared with Avenue Code will be kept confidential and will not be transmitted to disinterested third parties, nor will it be used for purposes other than the application for open positions. As a Consultancy company, Avenue Code may share your information with its clients and other Companies from the CompassUol Group to which Avenue Code’s consultants are allocated to perform its services.