О компании
Nord Security helps people and businesses protect their online security, privacy, and data. Its products include VPNs, password managers, threat intelligence, and travel eSIMs.
Задачи
•Conduct security reviews of application designs, source code, and third-party libraries and SDKs
•Perform regular application vulnerability assessments using automated tools and manual testing techniques, including SAST, DAST, SCA, and penetration testing
•Assess iOS applications end to end, including static and dynamic analysis and runtime instrumentation
•Collaborate with development teams to design secure architectures and implement security controls
•Maintain security tools, scripts, and processes that support secure development
•Monitor industry trends, zero-day vulnerabilities, platform security changes in new iOS releases, and application security best practices
•Develop scripts, security automation tools, and instrumentation harnesses to improve mobile application security testing
•Design and deliver security engineering awareness and adoption training
•Identify internal security gaps in products
•Ensure mobile applications are sufficiently tested and support internal and external audits, including MASVS-aligned assessments
Требования
•Experience planning and conducting mobile application security assessments, testing, and vulnerability reporting, with a focus on iOS
•Strong understanding of secure coding practices
•Ability to perform manual security code audits
•Proficiency in at least one native mobile programming language: Swift or Objective-C; comfortable reading C/C++ in dependencies
•Practical knowledge of OWASP MASVS and MASTG, and ability to plan and execute assessments against them
•Solid understanding of the iOS security model, including sandboxing, entitlements, code signing, Keychain, Data Protection classes, App Transport Security, IPC, and inter-app communication
•Hands-on experience with dynamic instrumentation and mobile testing tools, including Frida, Objection, MobSF, Burp Suite, mitmproxy, and class-dump/otool-style binary inspection
•Experience bypassing and assessing the resilience of client-side controls, including certificate pinning, jailbreak detection, and anti-tampering
•Solid understanding of TCP, UDP, HTTP, TLS, and mobile traffic interception
•Understanding of insecure data storage, sensitive data leakage, and cryptographic misuse in mobile apps
•Ability to use networking tools such as Wireshark and tcpdump
•Familiarity with iOS reverse engineering and debugging tools such as Ghidra, IDA, Hopper, and LLDB
•Ability to quickly learn new technologies and tools
•Strong ownership, problem-solving, and investigation skills
•Ability to build relationships and influence stakeholders across the business
Будет плюсом
Public CVEs, bug bounty recognition, open-source tools or blogs, Android application security, fuzzing tools and techniques
Условия
•Private health insurance in Lithuania and Poland, fully covered
•Extra vacation days, sick days, and time off
•Training, mentorship, and room to grow
•Free subscriptions to Calm, Headspace, and Mindletic, plus resilience and mindfulness training
•In-house gyms, sport cards, online workouts, and personal guidance
•Company-wide workation abroad
•Gifts for birthdays, weddings, and new family members
•Children's summer camps and schedule flexibility
•Team-building and company events
•Access to the Vilnius HQ facilities, including a coffee bar, open gyms, kids' room, music room, and massage chairs
Applications may be evaluated using automated tools and an AI-based review tool; each application is ultimately reviewed by a recruiter. Candidates may opt out of automated evaluation by applying directly.
