Seeking an experienced Senior Mobile & API Security / Penetration Testing Consultant with deep hands-on expertise in advanced Android, iOS, API, and backend security testing.

Responsibilities
• Perform advanced manual penetration testing of Android and iOS applications.
• Conduct API & backend security testing, including IDOR/BOLA, authorization bypass, and privilege escalation.
• Perform manual exploitation, vulnerability validation, and business-logic testing.
• Conduct mobile reverse engineering, runtime analysis, and tamper-resistance testing.
• Assess QR protocol and workflow security, including replay, manipulation, spoofing, substitution, and crafted payload attacks.
• Test scanner trust boundaries and identify potential debug/test-mode or workflow bypasses.
• Assess cryptographic implementations and key-management lifecycles.
• Perform threat modeling, attack-path analysis, and vulnerability chaining.
• Validate security remediation and perform retesting.
• Prepare qualified penetration-testing reports complete with Proof-of-Concepts (PoCs), impact analysis,



and actionable remediation steps.

Requirements
• 8+ years in cybersecurity with a focus on Mobile & API Penetration Testing.
• Hands-on experience with advanced Android & iOS security testing alongside API security testing (IDOR/BOLA, authentication, authorization).
• Proficiency in mobile reverse engineering, runtime analysis, manual exploitation, and vulnerability chaining.
• Practical expertise in QR protocol/security testing, fuzzing, applied cryptography, and key-management lifecycle assessment.
• Strong capabilities in threat modeling and business-logic vulnerability identification.
• Excellent technical writing skills with the ability to document PoCs, risk ratings, and detailed remediation guidance.

Preferred Skills
• Burp Suite, Frida, Objection, MobSF, JADX, Ghidra, ADB, Wireshark, or equivalent security-testing tools.
• OSCP, OSWE, OSED/OSCE, CREST, eWPTX, eMAPT, or equivalent certificat

📌 Senior Mobile (India)
🏢 RailsCarma
📍 India