Mobile Security Analyst (all genders) - Bug Bounty, Mobile Device Vulnerability Management, Threat Hunting

Zum Hauptinhalt springen

Start

Wir

Jobs

Recruitee

Mobile Security Analyst All Genders Bug Bounty Mobile Device Vulnerability Management Threat Hunting

DEEN

Taten

Übersicht

Projekte

Challenges und Funken

Strategische Projekte

Projektvorschlag einreichen

Informieren Sie sich über unsere Themen mit Sprunginnovationspotential oder reichen Sie Ihre eigene Idee ein.

Worte

Übersicht

Magazin

Podcast

Videothek

Veranstaltungen

Entdecken Sie Newsartikel, Podcasts und Videos zu aktuellen SPRIND-Themen.

Wir

SPRIND

Mitarbeit

Partnerschaften

Talentwerk

Lernen Sie SPRIND und Möglichkeiten für Partnerschaften kennen.

Kontakt

Impressum

Barrierefreiheit

Leichte Sprache

Barrierefreiheit

Mobile Security Analyst (all genders) - Bug Bounty, Mobile Device Vulnerability Management, Threat Hunting

ABOUT US

Common Codes is leading the development of Germany’s EUDI Wallet on behalf of the Federal Ministry for Digital Transformation and Government Modernisation. Our mission is to build secure, privacy-first and trustworthy digital public infrastructure. Together with partners from government, business, research and civil society, we are creating an open and interoperable ecosystem for digital credentials. The EUDI Wallet will enable public authorities and companies to offer new digital services, simplify processes and develop applications based on verifiable digital information. For citizens, it will provide a simple and secure way to identify themselves, store digital credentials and share only the information required in a specific situation. Whether opening a bank account, applying to a university or proving their age, users will remain in control of their personal data. By building this infrastructure, we are laying the foundation for a more accessible, efficient and trustworthy digital society. The EUDI Wallet will reduce bureaucratic barriers, make digital services easier to use and strengthen digital sovereignty in Germany and Europe

YOUR ROLE

As Mobile Security Analyst (all genders), you will support three closely linked security functions: the bug bounty and vulnerability disclosure programs, threat hunting mobile security threats which ultimately will feed into our Mobile Device Vulnerability Management (MDVM) solution.

In the internal bug bounty team, you will support technical triage and in-depth security assessment of vulnerability reports with a strong focus on mobile applications (iOS/Android), however you may also assist the team with technical triage support for some web applications and APIs. These important steps help build a robust and effective MDVM - tracking, assessing and acting on vulnerabilities in the device’s operating system, hardware key stores and wallet app integrity that ensure the security of the German EUDI Wallet.

YOUR RESPONSIBILITIES

Reproduce proof-of-concepts submitted through the bug bounty and the vulnerability disclosure program, and validate whether reported issues are exploitable in the relevant technical context.

Assess the severity, help realise the business impact and support the remediation priority of reported vulnerabilities across mobile, web and API surfaces.

Support the operational handling of vulnerability reports and take over selected coordination, communication and decision-making responsibilities when needed.

Retest remediated findings and verify whether fixes are complete and effective.

Monitor and assess vulnerabilities affecting user device operating systems, hardware key stores and wallet instances.

Evaluate the attack potential of newly disclosed OS/key store/chip vulnerabilities and contribute to risk-based decisions on device or wallet usage restrictions where integrity cannot be sufficiently verified.

Apply reverse engineering skills (static/dynamic analysis, instrumentation, runtime hooking) to independently validate mobile findings and collaborate with threat hunters on specific mobile investigations.

Help internal development teams identify the root cause of security issues, particularly in native mobile code, SDKs and third-party libraries.

Work with development teams on sustainable remediation measures that address the underlying cause, not only the individual attack path.

WHAT WE’RE LOOKING FOR

Strong hands-on experience in security testing mobile applications.

Strong hands-on experience of reverse engineering mobile applications (iOS and Android),

Hands-on experience in security testing of web applications and APIs.

Practical understanding of mobile platform security mechanisms: secure enclave/hardware-backed keystores, platform attestation (e.g. Android Key Attestation, iOS DeviceCheck/App Attest).

Strong knowledge of common vulnerability classes affecting mobile, web and API environments.

Good understanding of secure development lifecycle practices and how security findings can be translated into engineering action.

Ability to analyze technical findings precisely and explain them clearly to different stakeholders.

Strong written and verbal communication skills in English, especially in discussions with development teams and external researchers.

Sound judgment and the ability to make risk- and impact-based decisions, including under time pressure.

Structured and reliable way of working, including clear documentation and consistent follow-up.

NICE TO HAVE

Direct experience working with bug bounty or vulnerability disclosure programs.

Familiarity with common severity rating approaches such as CVSS and with risk-based vulnerability prioritization.

Experience supporting remediation in agile or product-oriented engineering environments.

Prior exposure to threat hunting methodology or mobile threat intelligence feeds.

Experience with digital identity, wallet or credential systems (e.g. OpenID4VCI, mDL/mDoc, eIDAS) and their mobile security implications.

Understanding of modern authentication and authorization patterns in API-centric systems.

Degree in information security, computer science, cybersecurity or a related field, or equivalent practical experience.

Working understanding of the German language.

WHAT WE OFFER

A chance to shape one of Germany’s most important digital public infrastructures

A forward-thinking, mission-driven work culture at the intersection of science, administration, and innovation

Flexible working hours and remote work from Germany

Competitive compensation commensurate with the level of responsibility

Access to conferences, team events and a supportive work culture.

DIVERSITY MATTERS TO US

We value different perspectives and experiences. That’s why we welcome applications from everyone, regardless of gender, nationality, ethnic or social background, religion or belief, disability, age, sexual orientation, or gender identity.

Jetzt bewerben

Bitte fülle das folgende Formular aus, um dich für die ausgeschriebene Position zu bewerben. Alle mit * markierten Felder sind Pflichtfelder.

Vorname*

Nachname*

E-Mail-Adresse*

Telefonnummer*

Anschreiben

Keine Datei ausgewählt

Akzeptierte Dateien: PDF, DOC, DOCX, JPEG und PNG bis zu 50 MB.

Oder Anschreiben hier schreiben

CV*

Keine Datei ausgewählt

Akzeptierte Dateien: PDF, DOC, DOCX, JPEG und PNG bis zu 50 MB.

Ich akzeptiere die Datenschutzerklärung*

Die Datenschutzerklärung für Bewerbungen findest du hier.

Bewerbung absenden

Newsletter

Email-Adresse*

Anmelden

Für die Anmeldung zum SPRIND Newsletter gelten die aktuellen Datenschutzhinweise.

FAQBarrierefreiheitCorporate GovernanceDatenschutzhinweise Impressum PresseKontaktLeichte Sprache

SprinD GmbH, Lagerhofstr. 4, 04103 Leipzig,