Senior Application Security Engineer

Tangem is a high-tech company in the blockchain sector was founded in 2017, headquartered in Zug, Switzerland, with branches in North America, Eastern Europe, and APAC.

Tangem started with the idea of bringing digital assets to the masses using a unique combination of a smartcard-based hardware wallet and mobile applications. Company owns and promotes the technology of hardware cold-wallet for digital assets with secure and simple UX in 220 countries today. Our customers enjoy setup time within 1 minute with the ultimate security level for digital assets on their wallet. Tangem solutions offer multi-support of a growing number of thousands of tokens by a single wallet. SBI Crypto Investment Ltd., the digital asset venture investment company wholly owned by SBI Holdings Inc., has invested $15 million into Tangem in 2019 for mass adoption of blockchain technology.

About the role

We're looking for a Senior Application Security Engineer to help keep Tangem's products secure, with a strong focus on iOS and Android applications.

You'll focus on finding security vulnerabilities in our mobile applications, reviewing application architecture, conducting threat modeling, and performing penetration testing. You'll work closely with developers, review new features from a security perspective, validate bug bounty reports, and help improve our overall security posture.

This is a hands-on role for someone who understands mobile development and enjoys both offensive security and working with engineering teams to build secure products.

Stack: Frida, MobSF, Burp Suite, OWASP MASVS/MASTG, Swift, SwiftUI/UIKit, Kotlin, Jetpack Compose, Coroutines

Responsibilities:

• Perform security assessments and penetration testing of iOS and Android applications using manual and automated approaches;

• Conduct security architecture reviews and threat modeling for mobile applications and new features;

• Perform security-focused source code reviews and identify vulnerabilities in security-critical components;

• Review new features before and after release to identify security risks;

• Investigate and validate bug bounty submissions;

• Work with developers and QA engineers to improve security testing practices and remediate vulnerabilities;

• Provide practical security guidance to engineering teams.

Requirements:

• 5+ years of experience in Application Security, Penetration Testing, Offensive Security, or a similar role;

• Strong understanding of iOS and Android application development, including Swift, Kotlin, mobile architecture, and platform security mechanisms;

• Practical experience performing penetration testing of both iOS and Android applications, including static and dynamic analysis;

• Experience conducting security architecture reviews and threat modeling;

• Experience with mobile security testing tools such as Frida, MobSF, Burp Suite, or similar;

• Good understanding of mobile security standards (OWASP MASVS/MASTG), cryptography, secure storage, and authentication mechanisms.

Nice to have:

• Experience with web application and API penetration testing;

• Experience with blockchain applications, cryptocurrency wallets, NFC, or secure element technologies;

• Experience participating in bug bounty programs or CTF competitions;

• Security certifications such as OSCP, OSWE, or similar;

• Experience integrating security testing into CI/CD pipelines.

What We Offer:

• Stability, development, participation in the future unicorn's growth;

• Remote work from anywhere in the world;

• Competitive salary in EUR/USDT;

• Unlimited vacation;

• Birthday presents;

• Compensation for the purchase of necessary technical devices for the work;

• Paid sick leaves.