Senior Mobile Security Specialist

About the role

FDM Group is seeking a Senior Mobile Security Specialist to join a finance‑focused client in Bristol on a six‑month contract, with the possibility of extension. The role is hybrid, combining on‑site collaboration with remote work, and will lead a small team of junior specialists to protect the client’s mobile platform.

Key responsibilities

• Lead and evolve the mobile security framework across all mobile platforms.
• Conduct and oversee mobile application penetration testing, vulnerability assessments and remediation.
• Perform threat modelling, security analysis and risk assessments for mobile apps and supporting services.
• Define and promote secure development standards, application hardening techniques and best practices.
• Implement and enhance security tooling, testing capabilities and automation to improve coverage and efficiency.
• Provide security consultancy and assurance to engineering teams throughout the development lifecycle.
• Mentor junior Mobile Security Specialists, offering technical guidance and quality oversight.
• Monitor emerging mobile security threats and drive continuous improvement of controls and processes.

Required profile

• Approximately 10+ years of experience in cyber security, application security or related fields.
• Deep expertise in mobile penetration testing, threat modelling, vulnerability management and security assurance.
• Strong knowledge of OWASP MASVS, MASTG and other mobile security standards.
• Proven experience securing iOS and Android applications, including authentication, authorisation, cryptography and API security.
• Demonstrated ability to design and implement security tooling and DevSecOps controls within CI/CD pipelines.
• Leadership, stakeholder management and consultancy skills, with a track record of mentoring security specialists.

Required skills

• iOS and Android application security
• OWASP MASVS, MASTG
• Mobile penetration testing tools: Burp Suite, MobSF, Frida, Objection, JADX, APKTool
• SAST, DAST, SCA platforms
• Application hardening: obfuscation, anti‑tampering, runtime protection
• CI/CD, DevSecOps automation