Mobile Security Analyst (all genders)

About the Position

Mobile Security Analyst (all genders)

Common Codes is at the forefront of developing Germany’s EUDI Wallet on behalf of the Federal Ministry for Digital Transformation and Government Modernisation. Our mission is to create a secure, privacy-first, and trustworthy digital public infrastructure. We are building an open and interoperable ecosystem for digital credentials, enabling public authorities and companies to offer new digital services, simplify processes, and develop applications based on verifiable digital information. For citizens, it will provide a simple and secure way to identify themselves, store digital credentials, and share only the information required in a specific situation.

As a Mobile Security Analyst (all genders), you will support three closely linked security functions: the bug bounty and vulnerability disclosure programs, threat hunting mobile security threats, which ultimately will feed into our Mobile Device Vulnerability Management (MDVM) solution.

Responsibilities

• Reproduce proof-of-concepts submitted through the bug bounty and the vulnerability disclosure program, and validate whether reported issues are exploitable in the relevant technical context.
• Assess the severity, help realize the business impact, and support the remediation priority of reported vulnerabilities across mobile, web, and API surfaces.
• Support the operational handling of vulnerability reports and take over selected coordination, communication, and decision-making responsibilities when needed.
• Retest remediated findings and verify whether fixes are complete and effective.
• Monitor and assess vulnerabilities affecting user device operating systems, hardware key stores, and wallet instances.
• Evaluate the attack potential of newly disclosed OS/key store/chip vulnerabilities and contribute to risk-based decisions on device or wallet usage restrictions where integrity cannot be sufficiently verified.
• Apply reverse engineering skills (static/dynamic analysis, instrumentation, runtime hooking) to independently validate mobile findings and collaborate with threat hunters on specific mobile investigations.
• Help internal development teams identify the root cause of security issues, particularly in native mobile code, SDKs, and third-party libraries.
• Work with development teams on sustainable remediation measures that address the underlying cause, not only the individual attack path.

Requirements

• Strong hands-on experience in security testing mobile applications.
• Strong hands-on experience in reverse engineering mobile applications (iOS and Android).
• Hands-on experience in security testing of web applications and APIs.
• Practical understanding of mobile platform security mechanisms: secure enclave/hardware-backed keystores, platform attestation (e.g., Android Key Attestation, iOS DeviceCheck/App Attest).
• Strong knowledge of common vulnerability classes affecting mobile, web, and API environments.
• Good understanding of secure development lifecycle practices and how security findings can be translated into engineering action.
• Ability to analyze technical findings precisely and explain them clearly to different stakeholders.
• Strong written and verbal communication skills in English, especially in discussions with development teams and external researchers.
• Sound judgment and the ability to make risk- and impact-based decisions, including under time pressure.
• Structured and reliable way of working, including clear documentation and consistent follow-up.

Nice to Have

• Direct experience working with bug bounty or vulnerability disclosure programs.
• Familiarity with common severity rating approaches such as CVSS and with risk-based vulnerability prioritization.
• Experience supporting remediation in agile or product-oriented engineering environments.
• Prior exposure to threat hunting methodology or mobile threat intelligence feeds.
• Experience with digital identity, wallet, or credential systems (e.g., OpenID4VCI, mDL/mDoc, eIDAS) and their mobile security implications.
• Understanding of modern authentication and authorization patterns in API-centric systems.
• Degree in information security, computer science, cybersecurity, or a related field, or equivalent practical experience.
• Working understanding of the German language.

We Offer

• A chance to shape one of Germany’s most important digital public infrastructures.
• A forward-thinking, mission-driven work culture at the intersection of science, administration, and innovation.
• Flexible working hours and remote work from Germany.
• Competitive compensation commensurate with the level of responsibility.
• Access to conferences, team events, and a supportive work culture.

About the Company

We value different perspectives and experiences. That’s why we welcome applications from everyone, regardless of gender, nationality, ethnic or social background, religion or belief, disability, age, sexual orientation, or gender identity.

Jetzt bewerben

Bitte fülle das folgende Formular aus, um dich für die ausgeschriebene Position zu bewerben. Alle mit * markierten Felder sind Pflichtfelder.

Vorname*

Nachname*

E-Mail-Adresse*

Telefonnummer*

Anschreiben

Keine Datei ausgewählt

Akzeptierte Dateien: PDF, DOC, DOCX, JPEG und PNG bis zu 50 MB.

Oder Anschreiben hier schreiben

Keine Datei ausgewählt

Akzeptierte Dateien: PDF, DOC, DOCX, JPEG und PNG bis zu 50 MB.

Ich akzeptiere die Datenschutzerklärung*

Die Datenschutzerklärung für Bewerbungen findest du hier.