Freelance Penetration Tester (OSCP) – Mobile Applications (iOS & Android)
Location: Germany (Remote within Europe preferred)
Start: ASAP
Duration: Minimum 3 months (extensions highly likely)
Workload: 30–40 hours per week
Engagement: Freelance / Contract
Overview
We are working with a leading Germany‑based technology provider operating in the smart mobility, tolling, and connected vehicle ecosystem. The organisation delivers secure, large‑scale digital platforms used across multiple European markets and places a strong emphasis on security, compliance, and reliability.
They are seeking an experienced freelance Penetration Tester (OSCP-certified) to support two parallel mobile application security assessments covering both iOS and Android platforms.
This is a hands-on technical role, ideal for a mobile-focused penetration tester who is comfortable working in regulated, production‑critical environments.
Key Responsibilities
- Perform end-to-end penetration testing of native iOS and Android applications
- Assess mobile applications against OWASP Mobile Top 10 and industry best practices
- Conduct testing of:
- Authentication and authorisation mechanisms
- Secure storage and key management
- API and backend communication used by mobile apps
- Encryption, certificate pinning, and secure transport
- App hardening and resistance to reverse engineering
- Identify vulnerabilities, document risk severity, and provide clear remediation guidance
- Produce high-quality technical reports suitable for:
- Engineering teams
- Security leadership
- Compliance and audit stakeholders
- Collaborate with developers and security teams to validate fixes and retest where required
Required Skills & Experience
- OSCP certification (mandatory)
- Proven experience in mobile application penetration testing
- Strong hands-on expertise with:
- iOS and Android security architecture
- Mobile reverse engineering tools (e.g. Frida, Objection, jadx, MobSF, Burp, etc.)
- Solid understanding of:
- Secure authentication flows
- API security
- Cryptography and key management on mobile platforms
- Experience working in regulated or security‑sensitive environments (e.g. automotive, fintech, mobility, payments) is highly desirable
- Ability to work independently and deliver to defined timelines
Nice to Have
- Experience testing applications used in connected vehicle, mobility, or large‑scale transaction environments
- Prior work with ISO 27001, TISAX, or similar security frameworks
- German language skills (not required, English is the working language)
Engagement Details
- Immediate start required
- 30–40 hours per week
- Initial contract of 3 months, with extensions very likely based on performance and project pipeline
- Competitive freelance rate, dependent on experience