Mobile Security Engineer — RASP
Primary stack
Nice to have's
Job description
About the Position
Mobile Security Engineer - RASP
Product Engineering - United Kingdom (Remote)
About Ditto
At Ditto, we're redefining digital trust. Our unified identity platform helps banks, financial institutions, governments and other regulated organisations verify identities, prevent fraud and deliver secure digital experiences through identity verification, authentication, passwordless access and mobile threat defence.
We're a global team with a startup mindset, led by CEO Gonzalo Alonso, on a mission to make digital trust simple, secure and accessible.
The Role
Ditto Protect is our mobile application security (RASP) platform - the runtime layer that keeps high-assurance apps safe while they run, on devices we do not control. We're hiring a Product Security Engineer to own the runtime defences that keep every Ditto Protect app trustworthy. This is a hands-on engineering role first and foremost: you'll write production code, contribute to the delivery pipeline, and ship the features that close gaps in Ditto Protect, working at high velocity with AI as your primary development accelerator.
Responsibilities
- Build and ship production-grade mobile security capabilities that close gaps in Ditto Protect's runtime detection and response coverage.
- Develop in-house security shields on top of a licensed RASP core, integrating and extending third-party and native SDKs through callback and event APIs.
- Work around vendor limitations, track defects, and keep the product current through annual platform upgrades.
- Build code-hardening capabilities including iOS symbol obfuscation and binary hardening across Swift, C, C++ and Objective-C.
- Own secure local storage, app/device attestation, and the applied cryptography that underpins them.
- Design, build and operate the Python backend services and APIs that turn on-device threat signals into operational visibility.
- Work alongside DevOps, who own the delivery pipeline, providing the engineering input required to keep builds, tests, signing and releases reliable.
- Write tests, collaborate with QA, and close defects directly in the code, owning quality end-to-end.
- Evaluate competing mobile security solutions and feed technical findings into the product roadmap.
- Support the Sales & Solutioning team with technical demos, POCs and credible answers for prospects and their security teams.
- Translate product gaps and requirements into epics and user stories in Jira that the team can build.
- Use AI coding tools to design, prototype, build, test and document at high speed.
- Own the capabilities you build throughout their lifecycle, including security research, vendor upgrades and ongoing maintenance.
Requirements
- Mobile SDK development: Experience with iOS (Swift/Objective-C) and/or Android (Kotlin/Java), ideally with a security or SDK focus.
- SDK integration and extension: Experience integrating and extending third-party or native SDKs via callback/event APIs, including working around vendor limitations.
- Code hardening: Applied obfuscation and binary hardening, including symbol obfuscation and anti-reverse-engineering techniques across native mobile toolchains.
- Applied cryptography fundamentals: Practical understanding of secure data-at-rest storage and attestation.
- Backend development in Python: Experience designing and building production Python services and APIs, particularly Flask, with sound testing, packaging and API-design discipline.
- AI-accelerated development: Proven experience building and shipping quickly with AI coding tools such as Claude Code, Copilot or Cursor.
- CI/CD collaboration: Practical experience with delivery pipelines such as GitHub Actions, GitLab CI, Jenkins or similar, and the ability to provide the engineering input those pipelines depend on.
- Cloud: Solid AWS experience; other cloud providers are a plus.
- Backend and platform engineering: Experience with dashboards/consoles, SIEM/log forwarding and observability, together with strong Git and Docker fundamentals.
- RASP and MTD: Hands-on knowledge of RASP and the mobile threat-and-defence landscape in which it operates.
- Standards: Familiarity with OWASP MASVS / MASTG and the mobile attacker toolkit, including Frida, Xposed, Magisk and emulators.
- Evaluation and pre-sales: Ability to evaluate competing security products and support pre-sales when needed.
- Quality and Agile delivery: Experience collaborating with QA, owning quality in your own code, and writing epics and user stories in Jira within an Agile team.
- Language: Written and spoken English to a professional standard.
Nice to Have
- Fraud management: Interest or experience extending mobile security beyond RASP/MTD into fraud.
- Server-side fraud engine experience: Transaction intelligence including velocity, amount spikes, new-payee and cross-channel history; device/identity baselining; and ML-based risk scoring, or close collaboration with data/ML teams, for use cases such as impossible travel, IP reputation, mule-account and anomaly detection.
- Real-time client↔server scoring: Experience defining the signal/risk-score contract between on-device and server layers and orchestrating both scores, for example via REL-ID-SDK, into an adaptive approve / step-up / block / alert response.
- Anti-fraud signals: Familiarity with behavioural biometrics, transaction risk, device intelligence and risk-adaptive (step-up) authentication, and how these complement rather than replace RASP/MTD.
- Live demos and POC environments: Experience creating and delivering credible technical demonstrations and proof-of-concept environments.
- EU regulatory awareness: Familiarity with PSD2 SCA, DORA, GDPR, PCI-DSS, and eIDAS 2.0 / EUDI Wallet.
- Domain background: Experience in a security vendor or fintech / banking environment.
We Offer
- Competitive salary
- Opportunity to work remotely from the United Kingdom
- Professional growth and development opportunities
- Collaborative and innovative work environment
About the Company
At Ditto, we are committed to creating a secure digital world. Our mission is to make digital trust simple, secure and accessible for all. Join us in redefining digital trust and making a significant impact in the industry.
Link to This Job
Location
United Kingdom (Remote)
Department
Product Engineering
Employment Type
Employee Full-Time
© Ditto Trade. This job description was sourced from the employer's public career page. TheJob is not the employer — we index the posting and route candidates to the source. All content rights and hiring decisions belong to the employer.
Ditto Trade is an Australian fintech startup financially backed and supported by a reputable company in the wealth management and brokerage industry.Led by a team of innovators and subject matter experts with skin in the game, Ditto aims to deploy exciting, cutting edge regulated financial products to a global audience with a focus on finance, data and behavioural science with a strong social community angle.