3 months ago
Hong Kong, Hong KongStaff+
Responsibilities
- Identify and remediate vulnerabilities in mobile code, systems, and networks using manual review, automated tooling, and threat modeling.
- Manage and optimize application security tools, processes, and alerts.
- Validate and respond to bug bounty submissions, triage findings, and coordinate remediation with engineering teams.
- Produce security findings reports and present them to technical and management audiences.
- Collaborate with development teams to implement secure coding practices across iOS and Android.
- Apply AI tools to security research, vulnerability detection workflows, and threat analysis.
- Work with operations and compliance teams to embed security across the organisation.
- Participate in incident response and management activities.
- Stay current on offensive security techniques, application security threats, and industry best practices.
Requirements
- 5+ years of experience in mobile application security or offensive security with hands-on iOS and/or Android expertise.
- Deep understanding of security risks, vulnerabilities, and concepts in mobile and web applications.
- Proficiency reviewing Kotlin, Swift, TypeScript, or JavaScript code and understanding application security threats.
- Ability to create vulnerability proof-of-concepts, review patches, and collaborate on remediation.
- Active use of AI tools to build and codify reliable security engineering workflows, including tools such as Claude Code or Codex.
- Strong analytical, problem-solving, verbal communication, and written communication skills.
- Preferred experience developing mobile security SDKs for products with more than ten million daily active users.
- Preferred experience with large-scale business risk control, threat intelligence, business risk prevention, and countermeasures against black and grey industries.
- Preferred deep reverse engineering experience with major applications.
- Preferred proficiency in ARM assembly and native- and application-layer security countermeasures.
- Preferred experience with device fingerprint recognition, device flashing, modification, and application cloning.
- Ability to work across multiple mobile platforms simultaneously.
Benefits
- L&D programs and education subsidy
- Team-building programs and company events
- Wellness and meal allowances
- Comprehensive healthcare schemes for employees and dependants
- Onsite role in Hong Kong
- Applicants must have current Hong Kong work authorization and not require visa sponsorship
Tech Stack
Categories
MobileSecurity
About OKX
OKX builds a global cryptocurrency exchange and Web3 wallet used by retail and institutional traders for spot, derivatives, and DeFi access, with developer APIs. Its business model centers on trading and financing fees, plus wallet and on-chain services. Founded in 2017 and privately held, OKX publishes monthly proof-of-reserves and operates as part of the OKG group serving crypto markets worldwide.