Sr. Penetration Tester (Android)/Mobile Tester

About the position

FocusKPI is looking for a Senior Penetration Tester (Android) or Mobile Tester to join one of our clients, a high-tech SaaS company. The client is looking for a Sr. Penetration Tester (Android) who will be responsible for working in a dual role as part of their Development Quality Innovation (DQI) lab. First, to research new automation tools as well as take current tools and refine them to our needs. Second, act as a centralized QI group to provide quality assessment and penetration testing operations. This duality provides a unique opportunity to explore new concepts in different technologies and perform original research in the quality and security domain.

Responsibilities

• Develop expertise in our product solutions, deep dive into design/architecture, & execute white box and black box penetration scenarios.
• Plan, scope, and conduct vulnerability assessment/ Penetration tests on internal/external facing public assets such as Web applications, Android platforms, Android Apps, Backend APIs, and Cloud services.
• Research & conduct adversary simulation for known security threats and identify novel attack vectors to test a system’s relative security readiness.
• Conduct Threat modeling, Threat Intelligence, and scoping with stakeholders.
• Assist in creating and maintaining internal penetration testing and practice within the QA team, managing vulnerabilities, and tracking until closure.
• Build a Test harness & required Automation suites and validate attack vectors in Threat Lab.
• Coordinate with program management and security architects at Internal & offshore sites.
• Stays up to date on current tools, technologies, and vulnerabilities to incorporate into testing practices.
• Research and development of exploits for zero-day vulnerabilities.
• Conduct penetration tests on IOT and firmware devices.

Requirements

• 5+ years’ experience in Penetration testing, including 3+ years experience in Android and 1+ years experience in Web Applications.
• Education: A Master's or Bachelor's degree in computers or related fields is required.
• Android pen testing is a must to have (Pen testing with any type of Android device).
• Experience with identifying high-critical vulnerabilities is also a must-have requirement.
• Good knowledge of Java, Python, and any relevant programming language (understanding how the code functions is highly required).
• Comprehensive knowledge of Information Security practices on malware, phishing attacks, attack vectors, and methods to protect against threats.
• Self-motivated individual with the ability to thrive in a team-based or independent environment.
• Detail-oriented with strong organizational skills.
• Ability to work in a fast-paced environment.
• Limited supervision and the exercise of discretion.

Nice-to-haves

• Certifications in offensive security: OSCP or OSWA or OSWE or CRTO or BSCP or similar is a plus.
• Malware development or reverse engineering experience is a plus.
• A degree in Cyber Security or Security relevant disciplines is a plus.
• Blog posts on security research, CVEs, walkthroughs, or PoCs in the security domain are a plus.

Benefits

• 12-month contract with the potential for conversion to full-time, depending on your performance in the future.
• Pay Range: $68/hr to $78/hr.
• Hybrid role (on-site 3 days a week) in Mountain View, CA.