Mobile Malware Engineer

Location: Linthicum Heights, MD • Full-time, on-site (Monday through Friday) • Active Top Secret clearance with SCI eligibility required

About the role

The Mobile Malware Engineer will analyze, reverse engineer, and characterize malicious software targeting Android and iOS platforms in support of a federal government customer. The engineer will evaluate complex malicious code using disassemblers, debuggers, hex editors, unpackers, virtual machines, and network sniffers. The engineer will investigate malicious code to determine attack vectors, payloads, and the extent of damage and data exfiltration, delivering actionable intelligence products that support national security missions.

Responsibilities

• Perform static and dynamic analysis of mobile malware on Android and iOS platforms.
• Reverse engineer ARM/ARM64 binaries, unpack APK/IPA files, bypass runtime protections, and reverse engineer known and suspected malware files.
• Identify C2 infrastructure, persistence mechanisms, and indicators of compromise (IOCs).
• Investigate attack vectors, payloads, and the extent of data exfiltration.
• Identify vulnerabilities in binaries and analyze shellcode; recommend preventative or defensive actions.
• Develop custom tooling, automation scripts, and YARA detection signatures.
• Build network- and host-based signatures and recommend heuristic- or anomaly-based detection methods.
• Produce technical reports with MITRE ATT&CK for Mobile mappings, remediation recommendations, and detailed documentation of malware behavior and command-and-control infrastructure.
• Conduct ongoing research into malicious software, emerging vulnerabilities, and exploitation tactics to stay ahead of evolving threats.
• Collaborate with forensics, vulnerability research, and cyber operations teams.

Requirements

• Bachelor’s degree plus 8 years of experience, or Master’s degree plus 6 years of experience (an additional four years of experience may be considered in lieu of a Bachelor’s degree).
• Degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, Information Systems, or a related field is highly desired.
• Hands-on experience with Ghidra, IDA Pro, Jadx, Frida, MobSF, and Corellium.
• Scripting experience in Python.
• Familiarity with Java, Kotlin, or Swift.
• Proficiency in ARM/ARM64 assembly and low-level binary analysis.
• Strong knowledge of Android and iOS internals, including APK/IPA structure, ART runtime, and Mach-O binaries.

Preferred Qualifications

• Experience with CNO toolchains or offensive mobile capability development.
• Familiarity with nation-state APT campaigns targeting mobile endpoints.
• Knowledge of MDM/EMM environments and mobile forensics tools, including Cellebrite and Oxygen Forensic.
• Published research, CVEs, or open-source contributions in mobile security.
• Certifications: GREM, GMOB, eMAPT, OSED, OSCP, CISSP, or CompTIA Security+.

Pay

$100,000 – $145,000 (depending on education level, years of experience, and certifications)