Application Security Engineer | Mid-Senior | iOS

The role

You will conduct security reviews of application designs, source code, and third-party libraries. You will perform vulnerability assessments and end-to-end security assessments of iOS applications.

What you will do

• Conduct security reviews of application designs, source code, and third-party libraries/SDKs
• Perform regular application vulnerability assessments using automated tools and manual testing
• Perform end-to-end security assessments of iOS applications
• Collaborate with development teams to design secure architectures and implement security controls
• Help maintain security tools, scripts, and processes
• Stay current with industry trends, zero-day vulnerabilities, and platform security changes
• Develop scripts, security automation tools and instrumentation harnesses
• Design and deliver training for security engineering awareness & adoption
• Actively look for internal security gaps within products
• Ensure mobile applications support internal and external audits

Required qualifications

• Proven experience in mobile application security assessment planning, testing, methodologies, and vulnerability reporting, with a focus on iOS
• Strong understanding of secure coding practices
• Ability to perform manual security code audit
• Proficiency in at least one mobile/native programming language (Swift, Objective-C)
• Comfort reading C/C++ where it appears in dependencies
• Practical knowledge of the OWASP MASVS and MASTG
• Solid understanding of the iOS security model
• Hands-on experience with dynamic instrumentation and mobile testing tooling such as Frida, Objection, MobSF, Burp Suite, mitmproxy and class-dump/otool-style binary inspection
• Experience bypassing client-side controls such as certificate pinning, jailbreak detection and anti-tampering
• Solid understanding of networking protocols such as TCP, UDP and the HTTP protocol, including TLS and traffic interception on mobile devices
• Understanding of insecure data storage, sensitive data leakage and cryptographic misuse in mobile apps
• Ability to work with networking tools such as Wireshark, tcpdump

Nice to have

• Community contributions like public CVEs, bug bounty recognition, open-source tools, blogs, etc.
• Familiarity with Android application security
• Familiarity with fuzzing tools and fuzzing techniques

Benefits

• Training, mentorship, and room to grow
• Extra vacation days, sick days, and time off
• Private health insurance in Lithuania and Poland
• Free subscriptions to Calm, Headspace, and Mindletic
• Resilience and mindfulness trainings
• In-house gyms, sport cards, online workouts, and personal guidance
• Company-wide trip abroad
• Gifts for birthdays, weddings, and new family members
• Children’s summer camps and flexibility around the schedule
• Team building and company events
• Access to Vilnius HQ with coffee bar, open gyms, kids’ room, music room, and massage chairs

About the company

Nord Security helps people and businesses take back control of their online security, privacy, and data. Their products include VPNs, password managers, threat intelligence, and eSIMs.