← All roles

Senior/Staff Mobile Security Engineer

Tools for Humanity· Engineering
Apply on company site
San Francisco$251k - $325kFull-timePosted 6mo ago

About the role

Senior/Staff Mobile Security Engineer responsible for designing, building, and operating the security features of the World App (Android and iOS), including mobile device attestation, anti-tampering protections, on-device cryptography, and server-side attestation verification to protect a high-value identity/payment ecosystem.

Responsibilities

  • Design, build, and operate mobile device attestation and integrity verification systems across Android and iOS including hardware-backed key attestation (Android KeyStore TEE/StrongBox, Apple App Attest/Secure Enclave) ensuring requests originate from genuine, untampered devices running unmodified app code.
  • Engineer anti-tampering, anti-hooking, and runtime integrity protections for the World App, making the app resilient against reverse engineering, instrumentation frameworks (Frida, Xposed), and repackaging attacks.
  • Own the mobile hardening strategy end-to-end: certificate pinning, secure storage, obfuscation, jailbreak/root detection, debugger detection, and screen capture protection deciding which protections to build in-house and which to source from vendors.
  • Design cryptographic protocols for on-device biometric authentication (Face Auth, selfie verification) resistant to replay, relay, and deepfake injection attacks.
  • Build and maintain the server-side attestation verification infrastructure (Attestation Gateway) that validates Play Integrity tokens, hardware attestation certificate chains, and Apple App Attest assertions.
  • Lead threat modeling for mobile-specific attack surfaces: biometric bypass, key extraction, device cloning, session hijacking, overlay attacks, accessibility abuse, and automated bot farms using real devices.
  • Embed security into the mobile development lifecycle performing deep code reviews of Android (Kotlin) and iOS (Swift) code, building automated security checks into CI/CD, and establishing secure coding standards for mobile teams.
  • Mature vulnerability management process for mobile, from triaging mobile-specific bug bounty submissions to driving remediation with mobile engineering teams.
  • Evaluate, integrate, and manage mobile security tooling and vendor relationships (RASP, SAST for mobile, binary analysis tools).

Qualifications

  • 8+ years of hands-on experience in mobile security engineering, with deep expertise in at least one of Android or iOS (strong in both ideal).
  • Proven experience designing and operating mobile device attestation systems (Android Hardware Key Attestation, KeyMint, TEE, StrongBox, attestation certificate chains, Google root CA verification; Google Play Integrity API; Apple App Attest).
  • Strong background in mobile application hardening: anti-tampering, anti-hooking, root/jailbreak detection, debugger detection, certificate pinning, runtime integrity protection in production apps.
  • Experience with mobile reverse engineering and offensive security: decompiling APKs (jadx, apktool), analyzing iOS binaries, using Frida/Objection for dynamic analysis.
  • Proficiency in Kotlin/Java (Android) and/or Swift (iOS) for security-focused code review and building security libraries.
  • Experience securing on-device cryptographic operations: key generation, secure storage (Android KeyStore, iOS Keychain), and hardware-backed keys.
  • Strong understanding of mobile-specific attack vectors: overlay attacks, accessibility service abuse, screen recording, deepfake injection into camera pipelines, biometric bypass, and app cloning.

Skills

Required:Mobile device attestationAnti-tampering and anti-hookingMobile app hardeningOn-device cryptographyServer-side attestation verification

Benefits

  • healthcare
  • dental
  • vision
  • 401(k) plan and match
  • life insurance
  • flexible time off
  • commuter benefits
  • professional development stipend
  • and much more
Last updated Jul 15, 2026. Interested? Apply on the company site.
Tools for Humanity logo

About Tools for Humanity

Tools for Humanity is a technology company building for humans in the age of AI.

Tools for Humanity is a technology company building for humans in the age of AI.

TechnologyAIWorldcoinOrbWorld
Company profileWebsite

More open roles at Tools for Humanity