Application security engineer

We're looking for a Senior Application Security Engineer to help keep Tangem's products secure, with a strong focus on iOS and Android applications. You'll focus on finding security vulnerabilities in our mobile applications, reviewing application architecture, conducting threat modeling, and performing penetration testing. You'll work closely with developers, review new features from a security perspective, validate bug bounty reports, and help improve our overall security posture. This is a hands-on role for someone who understands mobile development and enjoys both offensive security and working with engineering teams to build secure products.

• Perform security assessments and penetration testing of iOS and Android applications using manual and automated approaches;
• Conduct security architecture reviews and threat modeling for mobile applications and new features;
• Perform security-focused source code reviews and identify vulnerabilities in security-critical components;
• Review new features before and after release to identify security risks;
• Investigate and validate bug bounty submissions;
• Work with developers and QA engineers to improve security testing practices and remediate vulnerabilities;
• Provide practical security guidance to engineering teams.

• 5+ years of experience in Application Security, Penetration Testing, Offensive Security, or a similar role;
• Strong understanding of iOS and Android application development, including Swift, Kotlin, mobile architecture, and platform security mechanisms;
• Practical experience performing penetration testing of both iOS and Android applications, including static and dynamic analysis;
• Experience conducting security architecture reviews and threat modeling;
• Experience with mobile security testing tools such as Frida, MobSF, Burp Suite, or similar;
• Good understanding of mobile security standards (OWASP MASVS/MASTG), cryptography, secure storage, and authentication mechanisms.
• Будет плюсом: Experience with web application and API penetration testing; Experience with blockchain applications, cryptocurrency wallets, NFC, or secure element technologies; Experience participating in bug bounty programs or CTF competitions; Security certifications such as OSCP, OSWE, or similar; Experience integrating security testing into CI/CD pipelines

• Stability, development, participation in the future unicorn's growth;
• Remote work from anywhere in the world;
• Competitive salary in EUR/USDT;
• Unlimited vacation;
• Birthday presents;
• Compensation for the purchase of necessary technical devices for the work;
• Paid sick leaves.