Responsibilities
- Identify and remediate vulnerabilities in mobile code, systems, and networks using manual review, automated tooling, and threat modeling.
- Manage and optimize application security tools, processes, and alerts.
- Validate and respond to bug bounty submissions, triage findings, and coordinate remediation with engineering teams.
- Produce security findings reports and present them to technical and management audiences.
- Collaborate with development teams to implement secure coding practices across iOS and Android.
- Apply AI tools to security research, vulnerability detection workflows, and threat analysis.
- Work with operations and compliance teams to embed security across the organisation.
- Participate in incident response and management activities.
- Stay current on offensive security techniques, application security threats, and industry best practices.
Requirements
- 5+ years of experience in mobile application security or offensive security with hands-on iOS and/or Android expertise.
- Deep understanding of security risks, vulnerabilities, and concepts in mobile and web applications.
- Proficiency reviewing Kotlin, Swift, TypeScript, or JavaScript code and understanding application security threats.
- Ability to create vulnerability proof-of-concepts, review patches, and collaborate on remediation.
- Active use of AI tools to build and codify reliable security engineering workflows, including tools such as Claude Code or Codex.
- Strong analytical, problem-solving, verbal communication, and written communication skills.
- Preferred experience developing mobile security SDKs for products with more than ten million daily active users.
- Preferred experience with large-scale business risk control, threat intelligence, business risk prevention, and countermeasures against black and grey industries.
- Preferred deep reverse engineering experience with major applications.
- Preferred proficiency in ARM assembly and native- and application-layer security countermeasures.
- Preferred experience with device fingerprint recognition, device flashing, modification, and application cloning.
- Ability to work across multiple mobile platforms simultaneously.
Benefits
- L&D programs and education subsidy
- Team-building programs and company events
- Wellness and meal allowances
- Comprehensive healthcare schemes for employees and dependants
- Onsite role in Hong Kong
- Applicants must have current Hong Kong work authorization and not require visa sponsorship
Tech Stack
Categories
About OKX
At OKX, we believe that the future will be reshaped by Crypto, ultimately contributing to every individual's freedom. OKX began as a crypto exchange giving millions of people access to crypto trading and over time becoming among the largest platforms in the world. In recent years, we have developed one of the most connected Web3 wallets used by millions to access decentralized crypto applications (dApps). OKX is a trusted brand by hundreds of large institutions seeking access to crypto markets on a reliable platform that seamlessly connects with global banking and payments. In the last year, OKX has expanded into new markets including Australia, Brazil, Netherlands, Singapore and Turkey, with plans to launch in the US, Belgium and the UAE. We are deeply committed to shaping a fairer, more transparent and accessible society through blockchain technology. This is why we publish proof of reserves monthly, and continue to ship new innovative security features. We believe in good sportmanship and the pursuit to be better. You may see our OKX logo neatly fitted on the McLaren F1 cars, Manchester City FC team shirts, or at the Tribeca Film Festival celebrating artists and creators. Wherever you may find us, you will notice our pursuit of making our world more efficient, transparent, and connected. To learn more about OKX, download our app or visit: www.okx.com UK users follow: https://www.linkedin.com/company/okxuk/ Learn more about working at OKG, the business group developing OKX, our Digital Assets Exchange, our Web3 portal and blockchain ecosystems: bit.ly/WorkingatOKG