Security test engineer

Position Overview

The Security Test Engineer will join the ITG CDF team (BNP Paribas Group) and focus on mobile security testing. The role involves performing penetration tests, static and dynamic analysis, and reverse‑engineering of Android and iOS applications, as well as supporting web‑ and API‑level assessments.

Job Responsibilities

Direct Responsibilities

• Conduct Gray‑Box/Black‑Box penetration testing for Web, Mobile, API, and thick‑client applications.
• Perform hands‑on mobile testing (Android & iOS), covering both static (SAST) and dynamic (DAST) analyses of APKs/IPA files.
• Identify insecure storage, hard‑coded secrets, misconfigurations, runtime hooking, parameter tampering, etc.
• Reverse‑engineer mobile binaries, analyze native libraries (.so/.dylib), and bypass client‑side protections (root/jailbreak detection, SSL pinning, obfuscation, tamper checks) using tools such as Frida, Objection, Magisk, Cydia/Sileo/Zebra, Xposed.
• Stay current on evolving mobile threats and industry standards (OWASP MASVS/MASTG).
• Define and document test scope based on application security requirements.
• Execute documented security test scenarios and produce comprehensive findings reports.
• Collaborate with developers to explain vulnerabilities and recommend remediation.
• Escalate blockers to local management and on‑shore stakeholders when testing progress is impacted.
• Follow established assessment processes and ensure compliance with project guidelines.

Contributing / Supporting Responsibilities

• Assist in source‑code assessment (SCA/SAST) where required.
• Participate in knowledge‑sharing sessions and continuous improvement initiatives within the security testing team.

Required Education, Skills and Experience

• Education: Bachelor's degree (or equivalent) in Computer Science, Engineering, Information Security, or a related field.
• Experience: 4–6 years of hands‑on security testing, with a strong focus on mobile (Android & iOS) penetration testing.

• Technical Skills:
• Proficient in OWASP Top 10 concepts.
• Expertise with tools/OS: Burp Suite, OWASP ZAP, Kali Linux, MobSF, JADX, dex2jar, ADB, Xcode, Frida, Objection, Apktool, otool, etc.
• Strong manual testing, security test design, and vulnerability validation abilities.

• Behavioral Skills:
• Excellent verbal and written communication; strong presentation skills.
• Good analytical and time‑management capabilities.
• Independent, self‑motivated, flexible, and a collaborative team player.

Preferred Education, Skills and Experience (nice to have)

• Certifications such as CSSLP, CEH, or equivalent.
• Experience with source‑code assessment (SCA/SAST) and related tooling.
• Familiarity with additional mobile security frameworks (e.g., OWASP MASVS/MASTG) beyond the core requirements.

Location: Mumbai, Bangalore