{"id":16169,"date":"2026-09-24T14:47:48","date_gmt":"2026-09-24T07:47:48","guid":{"rendered":"https:\/\/galaxyholdings.co\/?post_type=job&p=16169"},"modified":"2026-09-24T14:47:48","modified_gmt":"2026-09-24T07:47:48","slug":"senior-mobile-application-penetration-tester","status":"publish","type":"job","link":"https:\/\/galaxyholdings.co\/en\/job\/senior-mobile-application-penetration-tester\/","title":{"rendered":"Senior Mobile Application Penetration Tester"},"content":{"rendered":"

Position Overview:<\/span><\/strong><\/h2>\n
    \n
  • Directly perform in-depth penetration testing on Android and iOS mobile applications (including native, Flutter, and React Native applications), along with the entire backend API serving the applications.<\/li>\n
  • Perform reverse engineering and dynamic analysis: bypass root\/jailbreak detection, SSL pinning, and anti-tampering\/RASP mechanisms to assess the application’s actual resilience.<\/li>\n
  • Assess the security of critical business flows on mobile: payments, eKYC\/biometric authentication, digital signatures, tokenization, and sensitive data storage on devices.<\/li>\n
  • Exploit and demonstrate vulnerabilities through controlled PoCs; rank risks based on business impact and perform retesting to verify remediation.<\/li>\n
  • Research new mobile attack techniques and malware; develop tools and automation scripts to support continuous testing and integration into the application release process.<\/li>\n
  • Provide technical consultation to the mobile development team on root causes and remediation solutions; support Blue Team\/SOC in developing attack detection capabilities targeting mobile users.<\/li>\n<\/ul>\n

    Key Responsibilities:<\/span><\/h2>\n

    1. Android and iOS Mobile Application Penetration Testing<\/span><\/h3>\n
      \n
    • Perform testing in accordance with OWASP MASVS\/MASTG on both platforms: static analysis (jadx, apktool, Ghidra\/IDA, MobSF) and dynamic analysis (Frida, objection, r2frida, Burp Suite).<\/li>\n
    • Test data storage on devices: Keychain\/Keystore, local databases, cache files, logs, backups, residual data in memory, and background screenshots.<\/li>\n
    • Test cryptographic mechanisms: weak algorithms, hardcoded keys in source code, insecure key generation, improper use of IV\/salt, and key lifecycle management.<\/li>\n
    • Test inter-process communication and platform attack surfaces: deep link\/App Link\/Universal Link, intent redirection, exported components, custom URL schemes, WebView vulnerabilities, and JavaScript bridges.<\/li>\n
    • Assess application protection mechanisms: root\/jailbreak detection, SSL pinning, anti-debugging, code obfuscation, RASP, Play Integrity API, and App Attest \u2013 determine their actual bypassability.<\/li>\n<\/ul>\n

      2. Backend API Testing and Critical Business Flow Testing<\/span><\/h3>\n
        \n
      • Test APIs serving mobile applications according to the OWASP API Security Top 10: BOLA\/IDOR, authorization flaws, rate limit abuse, and excessive data exposure.<\/li>\n
      • Test authentication and session management: OAuth 2.0\/OIDC, JWT, refresh tokens, device binding, biometric authentication (BiometricPrompt\/Face ID), and the ability to bypass controls at the client layer.<\/li>\n
      • Test payment and identity flows: tokenization, HCE\/NFC, online transactions, eKYC \u2013 including testing the bypass of liveness checks using images, videos, and AI-generated content (deepfake).<\/li>\n
      • Test mobile-specific business logic flaws: race conditions during transactions, client-side parameter manipulation, request replay, and account recovery flow abuse.<\/li>\n<\/ul>\n

        3. Assessment of Platform Risks, Third-Party SDKs, and Privacy<\/span><\/h3>\n
          \n
        • Review third-party SDKs\/libraries integrated into applications: publicly disclosed vulnerabilities, data collection activities beyond the disclosed scope, supply chain risks, and SBOM management for mobile applications.<\/li>\n
        • Assess permission requests and usage, leakage of personal data to third parties, and the accuracy of Google Play Data Safety and Apple Privacy Manifest.<\/li>\n
        • Assess compliance with Personal Data Protection Law No. 91\/2025\/QH15 and applicable sector-specific regulations for electronic transaction applications.<\/li>\n
        • Assess applications integrating AI\/LLM and on-device models: model extraction, prompt injection through input data, and data leakage through AI SDKs.<\/li>\n<\/ul>\n

          4. Research, Tool Development, and Test Automation<\/span><\/h3>\n
            \n
          • Monitor and analyze attack techniques and mobile banking malware (overlay, Accessibility Service abuse, biometric data theft) and assess their impact on the Group’s applications.<\/li>\n
          • Write PoCs\/exploit code for publicly disclosed and self-discovered vulnerabilities; research vulnerabilities in open-source frameworks and SDKs currently in use.<\/li>\n
          • Develop Frida scripts and internal tools (Python\/Bash), and extend existing tools to shorten testing time.<\/li>\n
          • Participate in integrating security testing into the mobile application CI\/CD pipeline (SAST\/SCA\/MobSF automated scanning on each build), and fine-tune rules to reduce false positives.<\/li>\n
          • Manage, back up, and upgrade the mobile testing lab infrastructure: rooted\/jailbroken physical devices, emulators, and virtualization platforms.<\/li>\n<\/ul>\n

            5. Reporting, Remediation Consulting, and Defensive Coordination<\/span><\/h3>\n
              \n
            • Prepare bilingual Vietnamese\u2013English penetration testing reports: technical descriptions, exploitation evidence, CVSS 4.0-based ranking linked to business impact, and feasible remediation recommendations.<\/li>\n
            • Present findings to mobile development teams and stakeholders; provide consultation on root causes, secure coding, and compensating controls when immediate patching is not possible.<\/li>\n
            • Convert exploitation scenarios into detection requirements for the Blue Team\/SOC; support the assessment of mobile application protection solutions (MTD\/RASP).<\/li>\n
            • Track remediation progress and perform retesting for Remediation Verification before releasing a new version to the App Store\/Google Play.<\/li>\n<\/ul>\n

              6. Methodology Standardization and Knowledge Sharing<\/span><\/h3>\n
                \n
              • Develop and periodically review processes, regulations, testing checklists, and report templates for the mobile application domain.<\/li>\n
              • Provide technical guidance and review the results of junior-level specialists.<\/li>\n
              • Organize internal knowledge-sharing sessions on new attack techniques; contribute secure coding training content for mobile development teams.<\/li>\n
              • Participate in advanced-level incident response and ad-hoc assessments when required.<\/li>\n<\/ul>\n

                Job Requirements:<\/span><\/h2>\n

                Mandatory Requirements:<\/span><\/h3>\n
                  \n
                • Bachelor’s degree or higher in Information Technology\/Information Security. Candidates from other majors are accepted if they can demonstrate equivalent hands-on capabilities (practical certifications, published CVEs, Bug Bounty\/CTF achievements).<\/li>\n
                • More than 4 years of experience in IT\/Information Security.<\/li>\n
                • More than 3 years of direct experience in mobile application penetration testing (excluding time spent on purely Web application testing, system operations, or SOC monitoring).<\/li>\n
                • Programming: proficient in Python and JavaScript (Frida scripting); able to read and understand Java\/Kotlin, Swift\/Objective-C, and Dart for white-box testing.<\/li>\n
                • Standards and regulations: OWASP MASVS, ISO\/IEC 27001:2022, PCI DSS 4.0.1 and mobile payment standards (MPoC\/SPoC), NIST CSF 2.0, Cybersecurity Law, Personal Data Protection Law No. 91\/2025\/QH15, and State Bank of Vietnam regulations on electronic transaction security and biometric authentication.<\/li>\n
                • Professional English: ability to read technical documentation and write reports.<\/li>\n
                • AI: training course or certification in AI Security \u2013 AI Red Teaming (e.g., SANS SEC535).<\/li>\n<\/ul>\n

                  (Acceptable alternative evidence of capabilities in lieu of certifications: CVEs published on mobile applications\/SDKs; rankings on HackerOne\/Bugcrowd\/Intigriti in the mobile category; self-developed open-source Frida tools or scripts; CTF awards in reverse engineering\/mobile categories.)<\/p>\n

                  Preferred:<\/span><\/h3>\n
                    \n
                  • Strong preference (mobile specialization): GMOB (SANS SEC575), eMAPT, CMPen-Android\/CMPen-iOS (Mobile Hacking Lab), mobile application penetration testing certifications from 8kSec\/Corellium.<\/li>\n
                  • Penetration testing platforms: OSCP\/OSCP+, OSWE, Burp Suite Certified Practitioner (BSCP), GWAPT (SANS SEC542) for the backend API component.<\/li>\n
                  • Additional: SANS SEC661 (Embedded\/ARM Exploitation), SEC522 (Application Security), Cloud Security certifications (AWS\/Azure\/GCP) for backend infrastructure.<\/li>\n
                  • Experience testing applications involving financial transactions, e-wallets, eKYC, or large-scale personal data processing is a significant advantage.<\/li>\n
                  • Experience in reverse engineering cross-platform applications (Flutter, React Native) and bypassing commercial protection mechanisms (RASP, obfuscation) is a significant advantage.<\/li>\n
                  • Prior mobile application development experience (Android\/iOS) before transitioning to security is a considerable advantage.<\/li>\n
                  • Preference for candidates who have worked at cybersecurity testing\/consulting companies or regularly participated in Bug Bounty programs.<\/li>\n
                  • Knowledge of highly regulated environments (finance \u2013 banking, aviation, real estate, digital services) is an advantage.<\/li>\n
                  • Preference for candidates who have taken on a technical lead role in a penetration testing project or mentored junior-level specialists.<\/li>\n<\/ul>\n

                    Skills:<\/span><\/h3>\n
                      \n
                    • Systematic offensive mindset: persist in reverse engineering and exploiting vulnerability chains rather than stopping at automated scanning tool results.<\/li>\n
                    • Translate technical vulnerabilities into business impact to convince development teams to prioritize remediation.<\/li>\n
                    • Write clear, reproducible reports and present results bilingually in Vietnamese\u2013English.<\/li>\n
                    • Analytical, problem-solving, and self-learning skills in researching new technologies in line with the pace of change in mobile operating systems.<\/li>\n
                    • Time management and ability to handle multiple testing projects in parallel according to application release schedules.<\/li>\n
                    • Cross-functional collaboration with mobile development, backend, operations, and SOC teams, and ability to mentor colleagues.<\/li>\n<\/ul>\n

                      Other Requirements:<\/span><\/h3>\n
                        \n
                      • Professional ethics and strict compliance with the testing scope (Rules of Engagement), NDA, and data protection regulations.<\/li>\n
                      • Absolutely no use of real customer data, accounts, or devices outside the approved scope.<\/li>\n
                      • Ability to work independently, proactively research, and continuously learn.<\/li>\n
                      • Willingness to perform testing outside regular working hours within approved testing windows, in accordance with the application release schedule.<\/li>\n
                      • Team spirit, strong commitment, and honesty in reporting results.<\/li>\n
                      • Clear criminal record\/background check (mandatory for positions with access to critical systems).<\/li>\n<\/ul>\n

                        Benefits:<\/span><\/strong><\/span><\/h2>\n
                          \n
                        • Competitive salary package (Base salary and performance bonuses).<\/li>\n
                        • Probation period salary is 100% of the official salary.<\/li>\n
                        • Comprehensive health and accident insurance.<\/li>\n
                        • 15 days of annual leave, 3 remote work days per month.<\/li>\n
                        • Provision of work equipment (Macbook\/ Laptop, mouse, monitor, etc.).<\/li>\n
                        • A creative and modern working environment.<\/li>\n<\/ul>\n

                          Working location: <\/span>Galaxy Innovation Hub \u2013 D1 Hi Tech Park, Tang Nhon Phu Ward, HCMC<\/b><\/span><\/p>\n

                          Kindly send your CV to: <\/span>talent@galaxyholdings.co\u00a0<\/b><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

                          Position Overview: Directly perform in-depth penetration testing on Android and iOS mobile applications (including native, Flutter, and React Native applications), along with the entire backend API serving the applications. Perform reverse engineering and dynamic analysis: bypass root\/jailbreak detection, SSL pinning, and anti-tampering\/RASP mechanisms to assess the application’s actual resilience. Assess the security of critical business […]<\/p>\n","protected":false},"template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}}},"class_list":["post-16169","job","type-job","status-publish","hentry","company-galaxy-holdings","location-ho-chi-minh"],"acf":[],"_links":{"self":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/job\/16169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/job"}],"about":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/types\/job"}],"wp:attachment":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/media?parent=16169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}