Security Engineer; Mobile Security

Position Summary

We have an opportunity available for Security Engineer to join us on a 12 month contract basis here at Samsung Research UK. You will be responsible for Android applications’ security assessment and for their approval and solution development to support B2B business for Samsung Galaxy devices. In particular supporting applications’ approval for government use and, depending upon opportunities, mobile solution development, deployment, provisioning and updates.

Expertise is required in the area of concept definition and security requirements for emerging security solutions leveraging Knox mobile software, hardware components on Galaxy devices, and Knox service infrastructure. Supporting solution development may also involve developing android applications, web services, smart card applications and mobile platform components, collaborating with internal and external stakeholders. You will have an interface role to play between potential partners/customers and internal stakeholders including business and R&D teams across the organisation.

You will be responsible for providing expertise in the area of mobile security to address both short and long-term requirements of enterprise customers across the globe.

• Producing security assessments and generating evidence reports for Samsung Galaxy applications as per acceptance requirements set by the government agencies. The security assessment task includes testing applications in line with well-known industry standards including: OWASP MASVS testing, threat modelling, tool relating to data flow analysis within the device and to the network; static and dynamic testing using tools such as MobSF, Frida, Jadx, cve-gin-tool and others for application risk assessment.
  
  These tasks may also require development of necessary tools for testing and hence development experience with programming languages such as Python is essential.
• Support Samsung partners and customers to build solutions based on Samsung Knox platform and Knox service infrastructure. This task includes development experience with front-end and back-end and web services using the latest IDE and tool chains.
• Depending upon needs, support Android and smartcard applications and mobile platform framework development tasks, in particular being responsible for functional specifications, requirements, design documentation along with supporting implementation and deployment, as necessary.
• Development of tools to enable solution installation, provisioning and approval.
• Creation of necessary documentation as per requirements to support approval of the solution including solution design and deployment guide documents.
• Coordination between internal and external stakeholders throughout the process and to support the product roadmap and strategy.
• Create necessary process documents to share with business stakeholders.
• Create necessary documents to describe issues encountered in an effective manner to get the right support from development teams.
• Travel as required, including to attend meetings with customers and partners.
• Timely provision of written progress reports to management and others, as required.

All work is to be of a professional standard, paying due regard to safety, efficiency, cost effectiveness, time scales and the needs of the company.

• A degree in Computing and Communications or any related discipline (an equivalent period of industrial experience may be substituted).
• Experience with application testing using various methods and tools including OWASP MASVS, MobfSF, Frida and tools to conduct static and dynamic testing.
• Knowledge of various device security attack vectors including apps, browsers, connectivity, device management, networking, local storage. etc.
• Knowledge of C, C++ and Java programming languages (at least 3 years’ experience). This experience is necessary to understand existing code and write test code to verify security requirements.
• Experience in development of Java Cryptography Extension (JCE) provider for Android Key Store.
• Familiarity with PKI, certificate enrolment, Public Key Cryptography Standards (PKCS #)
• Documentation…