[Hiring] Mobile Security Engineer @Ditto

Role Description

Ditto Protect is our mobile application security (RASP) platform — the runtime layer that keeps high-assurance apps safe while they run, on devices we do not control. We're hiring a Product Security Engineer to own the runtime defences that keep every Ditto Protect app trustworthy. This is a hands-on engineering role first and foremost: you'll write production code, contribute to the delivery pipeline, and ship the features that close gaps in Ditto Protect, working at high velocity with AI as your primary development accelerator.

• Build our in-house shields and hardening tooling on top of a licensed RASP core.
• Defeat rooting and jailbreaking, hooking and instrumentation, emulators, tampering and repackaging, malware, and network interception including MITM, SSL-pinning bypass, and malicious VPN/proxy.
• Own the applied cryptography beneath secure local storage and app/device attestation.
• Build and operate Ditto Protect's Python backend — the services and APIs that ingest threat telemetry from protected apps.
• Evaluate competing solutions and support the Sales & Solutioning team as a technical pre-sales engineer.
• Own capabilities across their lifetime, including ongoing security research, vendor upgrades, and maintenance.

Qualifications

• Strong, current, hands-on software engineering — you code daily and ship to production.
• Mobile SDK development — experience with iOS (Swift/Objective-C) and/or Android (Kotlin/Java), ideally with a security or SDK focus.
• SDK integration and extension — experience integrating and extending third-party or native SDKs via callback/event APIs.
• Code hardening — applied obfuscation and binary hardening, including symbol obfuscation and anti-reverse-engineering techniques.
• Applied cryptography fundamentals — practical understanding of secure data-at-rest storage and attestation.
• Backend development in Python — experience designing and building production Python services and APIs, particularly Flask.
• AI-accelerated development — proven experience building and shipping quickly with AI coding tools.
• CI/CD collaboration — practical experience with delivery pipelines such as GitHub Actions, GitLab CI, Jenkins or similar.
• Cloud — solid AWS experience; other cloud providers are a plus.
• Backend and platform engineering — experience with dashboards/consoles, SIEM/log forwarding and observability.
• RASP and MTD — hands-on knowledge of RASP and the mobile threat-and-defence landscape.
• Standards — familiarity with OWASP MASVS / MASTG and the mobile attacker toolkit.
• Evaluation and pre-sales — ability to evaluate competing security products and support pre-sales when needed.
• Quality and Agile delivery — experience collaborating with QA, owning quality in your own code.
• Language — written and spoken English to a professional standard.

Requirements

• Build and ship production-grade mobile security capabilities.
• Develop in-house security shields on top of a licensed RASP core.
• Work around vendor limitations, track defects, and keep the product current.
• Build code-hardening capabilities including iOS symbol obfuscation and binary hardening.
• Own secure local storage, app/device attestation, and the applied cryptography.
• Design, build and operate the Python backend services and APIs.
• Collaborate with DevOps to maintain reliable builds, tests, signing, and releases.
• Write tests, collaborate with QA, and close defects directly in the code.
• Evaluate competing mobile security solutions and feed technical findings into the product roadmap.
• Support the Sales & Solutioning team with technical demos, POCs, and credible answers.
• Translate product gaps and requirements into epics and user stories in Jira.
• Use AI coding tools to design, prototype, build, test, and document at high speed.
• Own the capabilities you build throughout their lifecycle.

Benefits

• Opportunity to work in a dynamic and innovative environment.
• Collaborate with a global team of experts.
• Contribute to meaningful projects that redefine digital trust.