Position: Junior Mobile Apps Security Engineer
Company: Cossack Labs
Category: Security
Experience required: 1y
English level: upper
Published: 2023-07-01T00:00:00+03:00

Cossack Labs is looking for a **Junior Mobile apps security engineer** to join our Security team and work with us on security testing of mobile applications.

If you are interested in breaking the apps, performing security assessments and describing security weaknesses, this may be the position for you!

**You will:**

— Participate in security assessments of mobile applications (iOS, Android, Flutter, React Native).
— Focus on platform-specific security controls (biometrics, security storage, device capabilities, reverse-engineering protections).
— Work together with developers to select security controls that would improve security without restricting usability/performance.
— Work on security of related applications: backend applications, hardware and embedded devices, because mobile apps do not live in vacuum.

**We would expect you to have:**

— Good understanding of OWASP MAS (MASVS + MASTG).
— Ability to read code, understand business logic and spot security mistakes in different mobile-relevant languages, like Swift, Objective-C, Kotlin, Java, JavaScript, TypeScript, Dart.
— Experience assessing or implementing mobile security controls, as well as platform-specific controls (Biometry on iOS, screenshot protections on Android, etc).
— Experience in performing security assessment for mobile and/or web applications.
— An overall understanding of what information security is, how real-world risks and threats affect the choice of security controls.

**As a plus you’d have**

— Experience with popular mobile stack: Xcode, Android Studio, TestFlight, Firebase, AppCenter, Bitrise, fastlane, etc.
— Mobile developer, QA engineer or Software engineer in Test (SET) experience.
— Experience in jailbreaking/rooting your devices.
— Experience in reverse engineering applications, bypassing TLS pinning, analysing source code.

**We offer:**

**(1) Unique area of expertise:**
— Interesting and challenging work in applied security engineering: from building to breaking.
— Working at the intersection of different areas: designing ML security controls, supporting cryptographic protocols with security controls, protecting hardware, building reverse-resilient mobile apps, securing web apps for million of users, etc.
— Combining technologies: cryptography, software engineering, information security. You won’t be bored :)
— Public track record in the open source part of our products, sharing your work as blogs posts, research papers and conference talks. We work with innovative companies all over the world, move quickly and dive into technologies others just hear about.
— A sense of meaning and responsibility for those who seek purpose – we’re building “invisible texture of modern civilization”—bits of infrastructure finance, power grids, healthcare rely on, and we are trusted with very challenging aspects of it.

**(2) Environment:**
— Friendly and experienced team: smart people to learn from, great people to build with. Each of us is unique, we value and support each other.
— An atmosphere that motivates you to grow and get smarter every month, a healthy ratio of routine / experimentation.
— Trust: schedule, reporting, bureaucracy is kept at reasonable minimum. We hire smart people and trust them to do the right thing. When things go wrong, we help rather than punish.
— Shared decision making: this business is driven by engineering excellence, so engineers are important part of tactical and strategical business decisions.
— Friendly to humans: not just a formal vacation and sick leave quota. Feel like your mental or physical wellbeing needs care? Take some time off. Feel like working a few days from home? Sure. As long as you’re in line, we are here to support you when you’re not.

**(3) Growth:**
— Team that facilitates internal learning and growth all the time.
Interesting technologies to work with — sometimes, even unique ones (we design applied cryptography schemes and techniques and novel ways to use them).
— Interesting engineering challenges across the board, ability to hop from high-level system design to protocol reverse engineering and clever data modelling hacks.
— Management attention to help you improve upon your personal goals (through regular 1:1s and mentoring).

**(4) Benefits:**
— Competitive compensation with flexible bonus scheme.
— Sick leaves, 21 vacation days a year, extra days off — according to agreements and laws.
— Conferences, books, courses — we encourage learning and sharing with the community. Our team members share a lot in talks, workshops and blog posts.