Mobile Malware Engineer

Amatriot Group; Linthicum (MD); On-site; USD 120,000 - 150,000; Full time

Job summary

Amatriot Group in Linthicum Heights, MD is seeking a Mobile Malware Engineer to analyze and reverse engineer malware targeting Android and iOS for a federal government customer. You will use disassemblers, debuggers and other tools to characterize threats and deliver actionable intelligence.

The role requires a TS clearance with SCI eligibility, strong skills in ARM assembly, binary analysis, and scripting in Python, plus experience with Ghidra, IDA Pro and Frida.

Qualifications

• Bachelor's or Master's degree in cybersecurity or a related field.
• 8+ years of experience in malware analysis or reverse engineering.
• Active Top Secret clearance with SCI eligibility.

Responsibilities

• Perform static and dynamic analysis of mobile malware on Android and iOS.
• Identify attack vectors, payloads and data exfiltration indicators.
• Produce technical reports with MITRE ATT&CK mappings and remediation recommendations.

Skills

ARM64 assembly

low level binary analysis

Python scripting

malware analysis

Android reverse engineering

iOS reverse engineering

threat hunting

Education

Bachelor's degree in related field

Master's degree in related field

Tools

Ghidra

IDA Pro

Jadx

Frida

MobSF

Corellium

Job description

Location Linthicum Heights MD full time on site Security Clearance Active TSSCI Required Job Type Full Time Target Salary Range 120000 150000 This represents the potential salary range for this position depending on education level years of experience andor certifications in addition to other position specific requirements which may impact salary Position OverviewThe Mobile Malware Engineer analyzes reverse engineers and characterizes malicious software targeting Android and iOS platforms in support of a federal government customer Using expertise in malware reverse engineering and analysis this role evaluates complex malicious code through tools including disassemblers debuggers hex editors unpackers virtual machines and network sniffers The engineer investigates malicious code to determine attack vectors payloads and the extent of damage and data exfiltration delivering actionable intelligence products that directly support national security missions

Key Responsibilities

• Mobile Malware AnalysisPerform static and dynamic analysis of mobile malware on Android and iOS platformsReverse engineer ARMARM64 binariesUnpack APK and IPA files bypass runtime protections and conduct reverse engineering of known and suspected malware filesIdentify vulnerabilities in binaries and analyze shellcodeInvestigate attack vectors payloads and the extent of data exfiltration
• Threat Detection and ResearchIdentify command and control C2 infrastructure persistence mechanisms and indicators of compromise IOCsDevelop custom tooling automation scripts and YARA detection signaturesBuild network and host based detection signatures and recommend heuristic or anomaly based detection methodsPerform ongoing research into malicious software emerging vulnerabilities and exploitation tactics
• Reporting and CollaborationProduce technical reports that include MITRE ATT&CK for Mobile mappings remediation recommendations and detailed documentation of malware behavior and command and control infrastructureRecommend preventative or defensive actions based on analysis findingsCollaborate with forensics vulnerability research and cyber operations teams

Qualifications

• EducationBachelors degree and 8 years of experience or Masters degree and 6 years of experienceDegree in Cybersecurity Computer Science Software Engineering Information Technology Information Systems or a related field is highly desiredAn additional four years of experience may be substituted in lieu of a Bachelors degree
• ExperienceProficiency in ARMARM64 assembly and low level binary analysisStrong knowledge of Android and iOS internals including APKIPA structure ART runtime and Mach O binariesHands on experience with Ghidra IDA Pro Jadx Frida MobSF and CorelliumExperience scripting in PythonFamiliarity with Java Kotlin or SwiftClearanceActive Top Secret clearance with SCI eligibility required

Preferred Qualifications

• ExperienceExperience with CNO toolchains or offensive mobile capability development
• Familiarity with nation state APT campaigns targeting mobile endpoints
• Knowledge of MDMEMM environments and mobile forensics tools including Cellebrite and Oxygen Forensic
• Published research CVEs or open source contributions in mobile security
• CertificationsGREMGMOBeMAPTOSEDOSCPCISSPCompTIA SecurityX