Position Overview:
- Directly perform in-depth penetration testing on Android and iOS mobile applications (including native, Flutter, and React Native applications), along with the entire backend API serving the applications.
- Perform reverse engineering and dynamic analysis: bypass root/jailbreak detection, SSL pinning, and anti-tampering/RASP mechanisms to assess the application’s actual resilience.
- Assess the security of critical business flows on mobile: payments, eKYC/biometric authentication, digital signatures, tokenization, and sensitive data storage on devices.
- Exploit and demonstrate vulnerabilities through controlled PoCs; rank risks based on business impact and perform retesting to verify remediation.
- Research new mobile attack techniques and malware; develop tools and automation scripts to support continuous testing and integration into the application release process.
- Provide technical consultation to the mobile development team on root causes and remediation solutions; support Blue Team/SOC in developing attack detection capabilities targeting mobile users.
Key Responsibilities:
1. Android and iOS Mobile Application Penetration Testing
- Perform testing in accordance with OWASP MASVS/MASTG on both platforms: static analysis (jadx, apktool, Ghidra/IDA, MobSF) and dynamic analysis (Frida, objection, r2frida, Burp Suite).
- Test data storage on devices: Keychain/Keystore, local databases, cache files, logs, backups, residual data in memory, and background screenshots.
- Test cryptographic mechanisms: weak algorithms, hardcoded keys in source code, insecure key generation, improper use of IV/salt, and key lifecycle management.
- Test inter-process communication and platform attack surfaces: deep link/App Link/Universal Link, intent redirection, exported components, custom URL schemes, WebView vulnerabilities, and JavaScript bridges.
- Assess application protection mechanisms: root/jailbreak detection, SSL pinning, anti-debugging, code obfuscation, RASP, Play Integrity API, and App Attest – determine their actual bypassability.
2. Backend API Testing and Critical Business Flow Testing
- Test APIs serving mobile applications according to the OWASP API Security Top 10: BOLA/IDOR, authorization flaws, rate limit abuse, and excessive data exposure.
- Test authentication and session management: OAuth 2.0/OIDC, JWT, refresh tokens, device binding, biometric authentication (BiometricPrompt/Face ID), and the ability to bypass controls at the client layer.
- Test payment and identity flows: tokenization, HCE/NFC, online transactions, eKYC – including testing the bypass of liveness checks using images, videos, and AI-generated content (deepfake).
- Test mobile-specific business logic flaws: race conditions during transactions, client-side parameter manipulation, request replay, and account recovery flow abuse.
3. Assessment of Platform Risks, Third-Party SDKs, and Privacy
- Review third-party SDKs/libraries integrated into applications: publicly disclosed vulnerabilities, data collection activities beyond the disclosed scope, supply chain risks, and SBOM management for mobile applications.
- Assess permission requests and usage, leakage of personal data to third parties, and the accuracy of Google Play Data Safety and Apple Privacy Manifest.
- Assess compliance with Personal Data Protection Law No. 91/2025/QH15 and applicable sector-specific regulations for electronic transaction applications.
- Assess applications integrating AI/LLM and on-device models: model extraction, prompt injection through input data, and data leakage through AI SDKs.
4. Research, Tool Development, and Test Automation
- Monitor and analyze attack techniques and mobile banking malware (overlay, Accessibility Service abuse, biometric data theft) and assess their impact on the Group’s applications.
- Write PoCs/exploit code for publicly disclosed and self-discovered vulnerabilities; research vulnerabilities in open-source frameworks and SDKs currently in use.
- Develop Frida scripts and internal tools (Python/Bash), and extend existing tools to shorten testing time.
- Participate in integrating security testing into the mobile application CI/CD pipeline (SAST/SCA/MobSF automated scanning on each build), and fine-tune rules to reduce false positives.
- Manage, back up, and upgrade the mobile testing lab infrastructure: rooted/jailbroken physical devices, emulators, and virtualization platforms.
5. Reporting, Remediation Consulting, and Defensive Coordination
- Prepare bilingual Vietnamese–English penetration testing reports: technical descriptions, exploitation evidence, CVSS 4.0-based ranking linked to business impact, and feasible remediation recommendations.
- Present findings to mobile development teams and stakeholders; provide consultation on root causes, secure coding, and compensating controls when immediate patching is not possible.
- Convert exploitation scenarios into detection requirements for the Blue Team/SOC; support the assessment of mobile application protection solutions (MTD/RASP).
- Track remediation progress and perform retesting for Remediation Verification before releasing a new version to the App Store/Google Play.
6. Methodology Standardization and Knowledge Sharing
- Develop and periodically review processes, regulations, testing checklists, and report templates for the mobile application domain.
- Provide technical guidance and review the results of junior-level specialists.
- Organize internal knowledge-sharing sessions on new attack techniques; contribute secure coding training content for mobile development teams.
- Participate in advanced-level incident response and ad-hoc assessments when required.
Job Requirements:
Mandatory Requirements:
- Bachelor’s degree or higher in Information Technology/Information Security. Candidates from other majors are accepted if they can demonstrate equivalent hands-on capabilities (practical certifications, published CVEs, Bug Bounty/CTF achievements).
- More than 4 years of experience in IT/Information Security.
- More than 3 years of direct experience in mobile application penetration testing (excluding time spent on purely Web application testing, system operations, or SOC monitoring).
- Programming: proficient in Python and JavaScript (Frida scripting); able to read and understand Java/Kotlin, Swift/Objective-C, and Dart for white-box testing.
- Standards and regulations: OWASP MASVS, ISO/IEC 27001:2022, PCI DSS 4.0.1 and mobile payment standards (MPoC/SPoC), NIST CSF 2.0, Cybersecurity Law, Personal Data Protection Law No. 91/2025/QH15, and State Bank of Vietnam regulations on electronic transaction security and biometric authentication.
- Professional English: ability to read technical documentation and write reports.
- AI: training course or certification in AI Security – AI Red Teaming (e.g., SANS SEC535).
(Acceptable alternative evidence of capabilities in lieu of certifications: CVEs published on mobile applications/SDKs; rankings on HackerOne/Bugcrowd/Intigriti in the mobile category; self-developed open-source Frida tools or scripts; CTF awards in reverse engineering/mobile categories.)
Preferred:
- Strong preference (mobile specialization): GMOB (SANS SEC575), eMAPT, CMPen-Android/CMPen-iOS (Mobile Hacking Lab), mobile application penetration testing certifications from 8kSec/Corellium.
- Penetration testing platforms: OSCP/OSCP+, OSWE, Burp Suite Certified Practitioner (BSCP), GWAPT (SANS SEC542) for the backend API component.
- Additional: SANS SEC661 (Embedded/ARM Exploitation), SEC522 (Application Security), Cloud Security certifications (AWS/Azure/GCP) for backend infrastructure.
- Experience testing applications involving financial transactions, e-wallets, eKYC, or large-scale personal data processing is a significant advantage.
- Experience in reverse engineering cross-platform applications (Flutter, React Native) and bypassing commercial protection mechanisms (RASP, obfuscation) is a significant advantage.
- Prior mobile application development experience (Android/iOS) before transitioning to security is a considerable advantage.
- Preference for candidates who have worked at cybersecurity testing/consulting companies or regularly participated in Bug Bounty programs.
- Knowledge of highly regulated environments (finance – banking, aviation, real estate, digital services) is an advantage.
- Preference for candidates who have taken on a technical lead role in a penetration testing project or mentored junior-level specialists.
Skills:
- Systematic offensive mindset: persist in reverse engineering and exploiting vulnerability chains rather than stopping at automated scanning tool results.
- Translate technical vulnerabilities into business impact to convince development teams to prioritize remediation.
- Write clear, reproducible reports and present results bilingually in Vietnamese–English.
- Analytical, problem-solving, and self-learning skills in researching new technologies in line with the pace of change in mobile operating systems.
- Time management and ability to handle multiple testing projects in parallel according to application release schedules.
- Cross-functional collaboration with mobile development, backend, operations, and SOC teams, and ability to mentor colleagues.
Other Requirements:
- Professional ethics and strict compliance with the testing scope (Rules of Engagement), NDA, and data protection regulations.
- Absolutely no use of real customer data, accounts, or devices outside the approved scope.
- Ability to work independently, proactively research, and continuously learn.
- Willingness to perform testing outside regular working hours within approved testing windows, in accordance with the application release schedule.
- Team spirit, strong commitment, and honesty in reporting results.
- Clear criminal record/background check (mandatory for positions with access to critical systems).
Benefits:
- Competitive salary package (Base salary and performance bonuses).
- Probation period salary is 100% of the official salary.
- Comprehensive health and accident insurance.
- 15 days of annual leave, 3 remote work days per month.
- Provision of work equipment (Macbook/ Laptop, mouse, monitor, etc.).
- A creative and modern working environment.
Working location: Galaxy Innovation Hub – D1 Hi Tech Park, Tang Nhon Phu Ward, HCMC
Kindly send your CV to: talent@galaxyholdings.co
