Security Engineer — Mobile RASP

About the Position

We're seeking a Security Engineer - Mobile RASP to join Ditto's Product Engineering team in Spain, focusing on mobile application security.

About the Role

At Ditto, we're redefining digital trust. Our unified identity platform helps banks, financial institutions, governments, and other regulated organizations verify identities, prevent fraud, and deliver secure digital experiences through identity verification, authentication, passwordless access, and mobile threat defense.

We're a global team with a startup mindset, led by CEO Gonzalo Alonso, on a mission to make digital trust simple, secure, and accessible.

Responsibilities

In this role, you'll:

• Build and ship production-grade mobile security capabilities that close gaps in Ditto Protect's runtime detection and response coverage.
• Develop in-house security shields on top of a licensed RASP core, integrating and extending third-party and native SDKs through callback and event APIs.
• Work around vendor limitations, track defects, and keep the product current through annual platform upgrades.
• Build code-hardening capabilities including iOS symbol obfuscation and binary hardening across Swift, C, C++ and Objective-C.
• Own secure local storage, app/device attestation, and the applied cryptography that underpins them.
• Design, build, and operate the Python backend services and APIs that turn on-device threat signals into operational visibility.
• Work alongside DevOps, who own the delivery pipeline, providing the engineering input required to keep builds, tests, signing, and releases reliable.
• Write tests, collaborate with QA, and close defects directly in the code, owning quality end-to-end.
• Evaluate competing mobile security solutions and feed technical findings into the product roadmap.
• Support the Sales & Solutioning team with technical demos, POCs, and credible answers for prospects and their security teams.
• Translate product gaps and requirements into epics and user stories in Jira that the team can build.
• Use AI coding tools to design, prototype, build, test, and document at high speed.
• Own the capabilities you build throughout their lifecycle, including security research, vendor upgrades, and ongoing maintenance.

Requirements

You are comfortable moving between mobile security, SDKs, backend services, and delivery infrastructure, and you take ownership of the quality and lifecycle of what you build. You'll bring:

• Strong, current, hands-on software engineering - you code daily and ship to production.
• Mobile SDK development - experience with iOS (Swift/Objective-C) and/or Android (Kotlin/Java), ideally with a security or SDK focus.
• SDK integration and extension - experience integrating and extending third-party or native SDKs via callback/event APIs, including working around vendor limitations.
• Code hardening - applied obfuscation and binary hardening, including symbol obfuscation and anti-reverse-engineering techniques across native mobile toolchains.
• Applied cryptography fundamentals - practical understanding of secure data-at-rest storage and attestation.
• Backend development in Python - experience designing and building production Python services and APIs, particularly Flask, with sound testing, packaging, and API-design discipline.
• AI-accelerated development - proven experience building and shipping quickly with AI coding tools such as Claude Code, Copilot, or Cursor.
• CI/CD collaboration - practical experience with delivery pipelines such as GitHub Actions, GitLab CI, Jenkins, or similar, and the ability to provide the engineering input those pipelines depend on.
• Cloud - solid AWS experience; other cloud providers are a plus.
• Backend and platform engineering - experience with dashboards/consoles, SIEM/log forwarding, and observability, together with strong Git and Docker fundamentals.
• RASP and MTD - hands-on knowledge of RASP and the mobile threat-and-defense landscape in which it operates.
• Standards - familiarity with OWASP MASVS / MASTG and the mobile attacker toolkit, including Frida, Xposed, Magisk, and emulators.
• Evaluation and pre-sales - ability to evaluate competing security products and support pre-sales when needed.
• Quality and Agile delivery - experience collaborating with QA, owning quality in your own code, and writing epics and user stories in Jira within an Agile team.
• Language - written and spoken English to a professional standard.

Nice to Have

It would be great if you also have:

• Fraud management - interest or experience extending mobile security beyond RASP/MTD into fraud - moving from “is the device safe?” to “should we trust this transaction?” This includes on-device behavioral signals such as typing rhythm, navigation, and gesture patterns, together with a local pre-scoring signal that fires before any server round-trip.
• Server-side fraud engine experience - transaction intelligence including velocity, amount spikes, new-payee, and cross-channel history; device/identity baselining; and ML-based risk scoring, or close collaboration with data/ML teams, for use cases such as impossible travel, IP reputation, mule-account, and anomaly detection.
• Real-time client↔server scoring - experience defining the signal/risk-score contract between on-device and server layers and orchestrating both scores, for example via REL-ID-SDK, into an adaptive approve / step-up / block / alert response.
• Anti-fraud signals - familiarity with behavioral biometrics, transaction risk, device intelligence, and risk-adaptive (step-up) authentication, and how these complement rather than replace RASP/MTD. This is also useful when evaluating solutions such as Bureau.
• Live demos and POC environments - experience creating and delivering credible technical demonstrations and proof-of-concept environments.
• EU regulatory awareness - familiarity with PSD2 SCA, DORA, GDPR, PCI-DSS, and eIDAS 2.0 / EUDI Wallet.
• Domain background - experience in a security vendor or fintech / banking environment.

We Offer

• Competitive salary
• Opportunity to work remotely from Spain
• Professional growth and development opportunities

About the Company

At Ditto, we're redefining digital trust. Our unified identity platform helps banks, financial institutions, governments, and other regulated organizations verify identities, prevent fraud, and deliver secure digital experiences through identity verification, authentication, passwordless access, and mobile threat defense.

We're a global team with a startup mindset, led by CEO Gonzalo Alonso, on a mission to make digital trust simple, secure, and accessible.