Application Security Engineer | Mid-Senior | iOS
Nord Security2 months ago
Remote, PolandMid Level / Senior
Responsibilities
- Conduct security reviews of application designs, source code, and third-party libraries or SDKs.
- Perform automated and manual vulnerability assessments, including SAST, DAST, SCA, penetration testing, static analysis, dynamic analysis, and runtime instrumentation.
- Assess iOS applications end to end and execute OWASP MASVS- and MASTG-aligned security assessments.
- Collaborate with development teams on secure architecture and implementation of security controls.
- Develop and maintain security tools, scripts, automation, and instrumentation harnesses for mobile application testing.
- Assess client-side controls such as certificate pinning, jailbreak detection, and anti-tampering.
- Support internal and external audits and identify security gaps in products.
- Deliver security awareness training and monitor iOS platform security changes and application security trends.
Requirements
- Proven experience planning, conducting, and reporting mobile application security assessments, particularly for iOS.
- Strong understanding of secure coding practices and ability to perform manual security code audits.
- Proficiency in at least one native mobile language, Swift or Objective-C, and ability to read C/C++ in dependencies.
- Practical knowledge of OWASP MASVS and MASTG.
- Strong understanding of iOS security concepts including sandboxing, entitlements, code signing, Keychain, Data Protection, App Transport Security, IPC, URL schemes, universal links, app extensions, and app groups.
- Hands-on experience with Frida, Objection, MobSF, Burp Suite, mitmproxy, and class-dump or otool-style binary inspection.
- Understanding of TCP, UDP, HTTP, TLS, mobile traffic interception, insecure data storage, sensitive data leakage, and cryptographic misuse.
- Ability to use Wireshark and tcpdump, with familiarity with Ghidra, IDA, Hopper, and LLDB.
- Strong investigation, problem-solving, ownership, stakeholder relationship-building, and influencing skills.
- Familiarity with Android application security and fuzzing tools or techniques is preferred.
- Community contributions such as public CVEs, bug bounty recognition, open-source tools, or security blogs are advantageous.
Benefits
- Training, mentorship, and professional development opportunities.
- Extra vacation days, sick days, and flexible time off.
- Fully covered private health insurance in Lithuania and Poland.
- Free Calm, Headspace, and Mindletic subscriptions and resilience and mindfulness training.
- In-house gyms, sport cards, online workouts, and personal guidance.
- Company-wide workation trip abroad.
- Work-from-anywhere arrangement.
- Gifts for birthdays, weddings, and new family members.
- Children’s summer camps and schedule flexibility for parents.
- Team-building activities and company events.
- Access to the Vilnius HQ Cyber City facilities, including a coffee bar, gyms, kids’ room, music room, and massage chairs.
About Nord Security
Nord Security builds consumer and business cybersecurity software under the Nord brand, including NordVPN, NordPass, NordLayer, and NordLocker. It sells subscription-based privacy and network security tools—VPN, zero-trust access, password management, encrypted storage, and threat exposure management—to individuals and companies globally. Founded in 2012 and headquartered in Vilnius, Lithuania, its products serve millions of users.