> Markdown version of [/jobs/ext/4568271-mobile-application-penetration-tester-remote](https://www.wearedevelopers.com/jobs/ext/4568271-mobile-application-penetration-tester-remote). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Mobile Application Penetration Tester- Remote

- **Company:** Calance Consulting Corporation
- **Location:** United States (Remote available)
- **Contract:** Contract
- **Skills:** Application Programming Interfaces (APIs), Android Software Development, Apple IOS, Business Logic, Software System Penetration Testing, User Authentication, Authentication Protocols, Black-Box Testing, Burp Suite, Computer Networks, Mobile Application Software, Key Management, Open Web Application Security, Session Management, Data Storage Technologies, Software Security, Backend, Tools for Reporting
- **Published:** November 4, 2026
- **Apply:** https://www.dice.com/job-detail/b349322a-f943-434e-863c-846830f47668

## About the Role

Demonstrated hands-on experience testing both iOS and Android applications.
Strong understanding of mobile architecture, API security, and common vulnerability classes.
Proficiency with tools such as Burp Suite, Frida, Objection, MobSF, and platform-specific testing utilities.
Ability to perform manual exploitation and business logic testing, not simply run automated scanners.
Experience producing professional, client-ready penetration testing reports with actionable remediation guidance.
Relevant certifications (OSCP, OSWE, OSEP, GMOB, or similar) are a plus, but practical mobile testing experience is more important.
Ideally, we d find one strong resource who can own the engagement end-to-end, although we can provide project oversight, QA, reporting tools, etc.

## Description

Applications: 4 mobile applications, each with iOS and Android versions (8 builds total).
Objective: Perform comprehensive security testing to identify vulnerabilities in the mobile applications, associated APIs, authentication mechanisms, and backend interactions.
Approach: Primarily manual penetration testing, supported by automated tooling, aligned with OWASP MASVS/MSTG (MASTG) and industry best practices.

Expected Scope
Black box testing of the applications.
Authentication, authorization, and session management testing.
API and backend communication security, including business logic vulnerabilities.
Local data storage, encryption, secrets management, and sensitive information exposure.
Network communications, certificate validation, and TLS implementation.
Platform-specific security controls for iOS and Android.
Testing of common mobile vulnerabilities, including those in the OWASP Mobile Top 10.
Documentation of findings, severity ratings, remediation recommendations, and supporting evidence