Application Security Engineer | Mid-Senior | iOS
Nord Security2 months ago
Kaunas, Lithuania or Vilnius, LithuaniaMid Level / Senior
Responsibilities
- Conduct security reviews of application designs, source code, third-party libraries, and SDKs.
- Perform automated and manual vulnerability assessments, including SAST, DAST, SCA, penetration testing, static analysis, dynamic analysis, and runtime instrumentation.
- Assess iOS applications end to end, including their security model, data handling, networking, client-side controls, and resilience against tampering.
- Collaborate with development teams on secure architectures and security controls.
- Develop and maintain security scripts, automation tools, and instrumentation harnesses.
- Maintain security tools, processes, and secure-development practices.
- Track zero-day vulnerabilities, iOS security changes, and application-security best practices.
- Deliver security-engineering awareness and adoption training.
- Identify internal security gaps and support internal and external audits, including MASVS-aligned assessments.
Requirements
- Proven experience planning, conducting, and reporting mobile application security assessments, particularly for iOS.
- Strong understanding of secure coding practices and ability to perform manual security code audits.
- Proficiency in Swift or Objective-C and comfort reading C and C++ dependencies.
- Practical knowledge of OWASP MASVS and MASTG and the ability to execute assessments against them.
- Strong understanding of iOS security concepts including sandboxing, entitlements, code signing, Keychain, Data Protection classes, App Transport Security, IPC, URL schemes, universal links, app extensions, and app groups.
- Hands-on experience with Frida, Objection, MobSF, Burp Suite, mitmproxy, and class-dump or otool-style binary inspection.
- Experience bypassing and assessing certificate pinning, jailbreak detection, and anti-tampering controls.
- Understanding of TCP, UDP, HTTP, TLS, mobile traffic interception, insecure data storage, sensitive-data leakage, and cryptographic misuse.
- Ability to use Wireshark and tcpdump.
- Familiarity with iOS reverse-engineering and debugging tools such as Ghidra, IDA, Hopper, and LLDB.
- Strong problem-solving, investigation, ownership, stakeholder-influence, and relationship-building skills.
- Familiarity with Android application security is advantageous.
- Familiarity with fuzzing tools and techniques is advantageous.
- Community contributions such as public CVEs, bug-bounty recognition, open-source tools, or security blogs are valued.
Benefits
- Training, mentorship, and professional-development opportunities.
- Extra vacation days, sick days, and additional time off.
- Fully covered private health insurance in Lithuania and Poland.
- Free Calm, Headspace, and Mindletic subscriptions plus resilience and mindfulness training.
- In-house gyms, sport cards, online workouts, and personal guidance.
- Company-wide workation trip abroad.
- Work-from-anywhere flexibility.
- Gifts for birthdays, weddings, and new family members.
- Children’s summer camps and flexible scheduling for parents.
- Team-building activities and company events.
- Access to the Vilnius headquarters’ coffee bar, gyms, kids’ room, music room, and massage chairs.
About Nord Security
Nord Security builds consumer and business cybersecurity software under the Nord brand, including NordVPN, NordPass, NordLayer, and NordLocker. It sells subscription-based privacy and network security tools—VPN, zero-trust access, password management, encrypted storage, and threat exposure management—to individuals and companies globally. Founded in 2012 and headquartered in Vilnius, Lithuania, its products serve millions of users.