Mobile Malware Engineer - TS-Eligible, National Security

The Amatriot Group; Linthicum (MD); On-site; USD 100,000 - 145,000; Full time

Job summary

The Amatriot Group seeks a Mobile Malware Engineer to analyze and reverse engineer threats targeting Android and iOS for a federal government client. You will use disassemblers, debuggers, and VM/sandbox tools to map attack vectors, payloads, and data exfiltration, delivering intelligence to support national security missions.

Responsibilities include static/dynamic analysis, reverse engineering ARM/ARM64, creating YARA rules and detections, and reporting findings with MITRE ATT&CK mappings.

Qualifications

• Bachelor's degree plus 8 years of experience, or Master's degree plus 6 years of experience [Required].
• Degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, Information Systems, or a related field is highly desired.
• Hands-on experience with Ghidra, IDA Pro, Jadx, Frida, MobSF, and Corellium [Required].
• Scripting experience in Python [Required].
• Familiarity with Java, Kotlin, or Swift [Required].
• Proficiency in ARM/ARM64 assembly and low-level binary analysis [Required].
• Strong knowledge of Android and iOS internals, including APK/IPA structure, ART runtime, and Mach-O binaries [Required].

Responsibilities

• Perform mobile malware analysis on Android and iOS platforms.
• Reverse engineer ARM/ARM64 binaries and unpack APK/IPA files.
• Identify C2 infrastructure, persistence mechanisms, and IOCs.
• Investigate attack vectors and data exfiltration; produce actionable intelligence.

Skills

ARM/ARM64 assembly

Android/iOS internals

Python scripting

Java/Kotlin/Swift

Education

Bachelor's degree in Cybersecurity, CS, or related field

Additional four years of experience in lieu of a Bachelor's degree

Tools

Ghidra

IDA Pro

Jadx

Frida

MobSF

Corellium

Job description

The Amatriot Group seeks a Mobile Malware Engineer to analyze and reverse engineer threats targeting Android and iOS for a federal government client. You will use disassemblers, debuggers, and VM/sandbox tools to map attack vectors, payloads, and data exfiltration, delivering intelligence to support national security missions.

Responsibilities include static/dynamic analysis, reverse engineering ARM/ARM64, creating YARA rules and detections, and reporting findings with MITRE ATT&CK mappings.