Senior Security Engineer

About the Role:

Were looking for an experienced engineer to help us understand and interact with web and mobile application APIs in a structured and compliant manner. This includes analyzing how apps and websites generate secure API requests, inspecting native/mobile code, and building reliable systems for data extraction, strictly in accordance with terms of service.

Key Responsibilities:

• Analyze Android apps (Java/Kotlin/native code) to understand API flows and request signing mechanisms.
• Study browser and JavaScript behavior to understand how websites structure and secure their API calls.
• Investigate how common client-side security mechanisms (e.g., token generation, header signing, session validation) are implemented.
• Build tools or automation scripts to replicate legitimate client behavior in a compliant and respectful manner.
• Collaborate with internal teams to integrate and maintain data extraction systems responsibly.

Must-Have Skills:

• Experience in reverse engineering Android apps (APK analysis, native code inspection).
• Deep understanding of web technologies, JavaScript execution, and HTTP protocol.
• Familiarity with client-side security implementations such as token generation, obfuscation, and API protection.
• Must have a solid understanding of JWT, JWE, cookies, and session management in web and mobile applications.
• Hands-on experience with tools like Frida, mitmproxy, Burp Suite, Wireshark, Ghidra/IDA Pro or similar.
• Strong scripting skills (Python, Node.js, etc.).

Nice-to-Have:

• Background in security engineering, penetration testing, or application security research.
• Familiarity with CAPTCHA handling methods and automation frameworks (e.g., Puppeteer, Playwright).
• Experience with mobile app instrumentation (NDK, JNI).
• Experience working with large-scale distributed systems, as it helps in building scalable and resilient data extraction infrastructure.