Mobile Malware Engineer

The Amatriot Group; Linthicum (MD); On-site; USD 120,000 - 150,000; Full time

Job summary

The Amatriot Group in Linthicum Heights, MD is seeking a Mobile Malware Engineer to analyze, reverse engineer, and characterize malicious software targeting Android and iOS for a federal government customer.

You will use tools like Ghidra, IDA Pro, Jadx, Frida, MobSF, and Corellium to unpack and reverse engineer binaries, identify attack vectors, and develop actionable intelligence and MITRE ATT&CK mappings.

Qualifications

• 8+ years with Bachelor's or 6+ years with Master in cybersecurity/CS/related field.
• Proficient in ARM/ARM64 assembly and binary analysis.
• Strong knowledge of Android/iOS internals and APK/IPA structures.
• Experience with malware analysis, reverse engineering, and tooling.

Responsibilities

• Perform mobile malware analysis on Android and iOS platforms.
• Reverse engineer ARM/ARM64 binaries and unpack APK/IPA files.
• Identify attack vectors, exfiltration, and data losses; produce findings.
• Develop MITRE ATT&CK mappings and detection signatures.
• Collaborate with forensics, vulnerability research, and cyber ops teams.

Skills

ARM/ARM64 assembly

Android/iOS internals

Python scripting

Java/Kotlin/Swift basics

Malware analysis

Reverse engineering

Education

Bachelor's degree in Cybersecurity/CS/SE or related field

Master's degree in Cybersecurity/CS or related field

Tools

Ghidra

IDA Pro

Jadx

Frida

MobSF

Corellium

Job description

Location: Linthicum Heights, MD (full-time on-site)

Security Clearance: Active TS/SCI [Required]

Job Type: Full-Time

Target Salary Range*: $120,000 - $150,000

• This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview

The Mobile Malware Engineer analyzes, reverse engineers, and characterizes malicious software targeting Android and iOS platforms in support of a federal government customer. Using expertise in malware reverse engineering and analysis, this role evaluates complex malicious code through tools including disassemblers, debuggers, hex editors, unpackers, virtual machines, and network sniffers. The engineer investigates malicious code to determine attack vectors, payloads, and the extent of damage and data exfiltration, delivering actionable intelligence products that directly support national security missions.

Key Responsibilities

Mobile Malware Analysis

• Perform static and dynamic analysis of mobile malware on Android and iOS platforms.
• Reverse engineer ARM/ARM64 binaries.
• Unpack APK and IPA files, bypass runtime protections, and conduct reverse engineering of known and suspected malware files.
• Identify vulnerabilities in binaries and analyze shellcode.
• Investigate attack vectors, payloads, and the extent of data exfiltration.

Threat Detection and Research

• Identify command-and-control (C2) infrastructure, persistence mechanisms, and indicators of compromise (IOCs).
• Develop custom tooling, automation scripts, and YARA detection signatures.
• Build network- and host-based detection signatures and recommend heuristic or anomaly-based detection methods.
• Perform ongoing research into malicious software, emerging vulnerabilities, and exploitation tactics.

Reporting and Collaboration

• Produce technical reports that include MITRE ATT&CK for Mobile mappings, remediation recommendations, and detailed documentation of malware behavior and command-and-control infrastructure.
• Recommend preventative or defensive actions based on analysis findings.
• Collaborate with forensics, vulnerability research, and cyber operations teams.

Qualifications

Education

• Bachelor's degree and 8 years of experience, or Master's degree and 6 years of experience.
• Degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, Information Systems, or a related field is highly desired.
• An additional four years of experience may be substituted in lieu of a Bachelor's degree.

Experience

• Proficiency in ARM/ARM64 assembly and low-level binary analysis.
• Strong knowledge of Android and iOS internals, including APK/IPA structure, ART runtime, and Mach-O binaries.
• Hands‑on experience with Ghidra, IDA Pro, Jadx, Frida, MobSF, and Corellium.
• Experience scripting in Python.
• Familiarity with Java, Kotlin, or Swift.

Clearance

• Active Top Secret clearance with SCI eligibility required.

Preferred Qualifications

Experience

• Experience with CNO toolchains or offensive mobile capability development.
• Familiarity with nation‑state APT campaigns targeting mobile endpoints.
• Knowledge of MDM/EMM environments and mobile forensics tools, including Cellebrite and Oxygen Forensic.
• Published research, CVEs, or open‑source contributions in mobile security.

Certifications

• GREM
• GMOB
• eMAPT
• OSED
• OSCP
• CISSP
• CompTIA SecurityX