Mobile App Security Engineer

Role overview A Mobile App Security Engineer is needed to safeguard native iOS and Android applications and the channels through which they connect to backend services. The role works alongside mobile, backend, and security teams to embed security practices into development and release processes within a financial services organisation operating across Southeast Asia.

Responsibilities - Assess and review native iOS and Android applications built with Swift and Kotlin. - Apply OWASP MASVS and MASTG to define mobile security requirements, test coverage, and remediation priorities. - Audit secure local storage, Keychain and Keystore usage, handling of sensitive data, sessions, tokens, and data leakage risks. - Implement and test transport security, including certificate validation and certificate pinning where appropriate. - Evaluate tamper detection, jailbreak and root detection, anti-debugging, and runtime protection controls proportionate to risk. - Partner with API and backend teams on authentication, authorisation, API exposure, and secure mobile communication. - Own mobile security controls for SC TRM and BNM RMiT, including testing evidence, vulnerability remediation, release controls, and audit support.

Requirements - Degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience. - Three or more years in mobile development, mobile security, or mobile penetration testing. - Hands-on experience implementing and owning SC TRM and BNM RMiT controls relevant to mobile applications and secure technology delivery. - Practical native iOS development or code review experience using Swift, and Android experience using Kotlin. - Working knowledge of OWASP MASVS and MASTG, mobile threat modelling, and mobile testing tools. - Experience with secure storage, certificate pinning, jailbreak and root detection, tamper resistance, authentication, and mobile API security. - Ability to collaborate with mobile developers and clearly communicate findings, trade-offs, and remediation steps.

Nice to have - Strong English communication skills are required as English is the primary working language across global teams.