Security Engineer - SAST/DAST

Job Description :

We are seeking a highly skilled Mobile App Payments and Red Teaming Engineer to strengthen the security posture of our mobile payment ecosystem through advanced offensive security testing and adversary simulation exercises. The role will focus on identifying vulnerabilities within mobile applications, payment systems, APIs, backend infrastructure, and associated digital assets through penetration testing and realistic red-team engagements. The ideal candidate should possess strong expertise in mobile application security, payment security standards, adversary simulation techniques, and offensive security methodologies.

The core responsibilities for the job include the following :

Mobile Application Security Assessment :

• Perform penetration testing on Android and iOS mobile applications.

• Assess security posture of mobile payment applications and digital wallets.

• Conduct static and dynamic application security testing (SAST/DAST).

• Perform API security testing for payment interfaces and backend services.

• Analyze authentication mechanisms, including OAuth, JWT, SSO, biometrics, and MFA implementations.

• Identify vulnerabilities such as insecure data storage, broken authentication, improper session management, reverse engineering risks, code tampering, SSL pinning bypass issues, runtime manipulation risks, and root/jailbreak detection bypasses.

Payment Security Assessment :

• Conduct security assessments on payment gateways, UPI integrations, digital wallets, card payment ecosystems, tokenization mechanisms, and QR payment implementations.

• Validate compliance with PCI-DSS, PCI Secure Software Standards, OWASP MASVS, OWASP Mobile Top 10 and payment industry security controls.

Red Team Operations :

• Design and execute realistic adversary simulation exercises.

• Conduct red-team assessments across mobile, cloud, API, and payment environments.

• Emulate attacker tactics, techniques, and procedures (TTPs).

• Perform phishing simulation exercises, social engineering assessments, credential attack simulations, lateral movement testing, privilege escalation exercises, and persistence technique validation.

• Map findings against the MITRE ATT&CK framework.

Security Research and Threat Intelligence :

• Research emerging attack vectors impacting mobile payment ecosystems.

• Analyze fraud trends and evolving threats targeting digital payment platforms.

• Develop proof-of-concept exploits for identified vulnerabilities.

• Recommend mitigation strategies and security improvements.