Mobile Application Penetration Tester- Remote

Applications: 4 mobile applications, each with iOS and Android versions (8 builds total). Objective: Perform comprehensive security testing to identify vulnerabilities in the mobile applications, associated APIs, authentication mechanisms, and backend interactions. Approach: Primarily manual penetration testing, supported by automated tooling, aligned with OWASP MASVS/MSTG (MASTG) and industry best practices.

Expected Scope Black box testing of the applications. Authentication, authorization, and session management testing. API and backend communication security, including business logic vulnerabilities. Local data storage, encryption, secrets management, and sensitive information exposure. Network communications, certificate validation, and TLS implementation. Platform-specific security controls for iOS and Android. Testing of common mobile vulnerabilities, including those in the OWASP Mobile Top 10. Documentation of findings, severity ratings, remediation recommendations, and supporting evidence

Demonstrated hands-on experience testing both iOS and Android applications. Strong understanding of mobile architecture, API security, and common vulnerability classes. Proficiency with tools such as Burp Suite, Frida, Objection, MobSF, and platform-specific testing utilities. Ability to perform manual exploitation and business logic testing, not simply run automated scanners. Experience producing professional, client-ready penetration testing reports with actionable remediation guidance. Relevant certifications (OSCP, OSWE, OSEP, GMOB, or similar) are a plus, but practical mobile testing experience is more important. Ideally, we d find one strong resource who can own the engagement end-to-end, although we can provide project oversight, QA, reporting tools, etc.