About The Opportunity

Responsible for leading the security gap analysis, threat modeling, and remediation architecture across Mitek’s iOS, Android, and Web capture layers to achieve CEN/TS 18099 certification readiness. This engineer (or specialized group covering iOS, Android, and Web) will evaluate current signal collection against modern injection attacks (unnamed virtual camera drivers, OS-level hooks, frame injection), map existing controls to ETSI TS 119 461 / eIDAS 2.0 standards, and define technical remediation specifications. They will guide SDK implementation developers, conduct security code reviews, and simulate dynamic injection attacks (Frida, virtual camera drivers) to validate that closed gaps meet certification-grade rigor.

Responsibilities

Standards Mapping & Gap Analysis: Perform control-by-control security reviews against CEN/TS 18099 and ETSI TS 119 461 requirements across iOS, Android, and Web capture pipelines.
Architecture & Signal Specification: Design non-spoofable hardware attestation patterns (Android Keystore / iOS Secure Enclave), secure frame chain-of-trust mechanisms, and temporal cross-frame sensor correlation protocols.
Web Anti-Fraud Strategy: Define browser fingerprinting, anti-automation (Puppeteer/Playwright detection), and hardware/WebGL probing mechanisms to identify virtual webcams while remaining privacy-compliant.
Developer Guidance & PR Reviews: Translate security findings into precise engineering specs for Android, iOS, and Web developers, assisting in code reviews and pull-request security evaluations.
Adversarial Validation: Simulate dynamic injection attacks (unnamed virtual camera drivers, OS-level hooks, Frida/Xposed dynamic instrumentation) to validate that remediation measures close identified vulnerabilities without driving up false rejection rates.

SOW Requirement Coverage

SOW Requirements 1.1 - 1.4 (Project 1 Discovery): Delivers the control-by-control CEN/TS 18099 gap analysis, root-cause assessment of false rejections/signal staleness, candidate signal evaluation across iOS/Android/Web, and the finalized Project 2 remediation roadmap.
SOW Requirements 2.1 - 2.6 (Architecture & Guidance): Architecturally defines implementation specifications for Android Keystore / iOS Secure Enclave attestation, frame integrity chains, cross-frame sensor correlation, browser fingerprint expansion, and C++ check consolidation.

Risk Mitigation

Identifies design flaws early and guarantees security controls meet third‑party evaluation lab criteria prior to code freeze, mitigating certification audit failure.

Required Qualifications

Domain Expertise: Deep background in mobile and web security, anti‑fraud, or biometric liveness defenses. Direct familiarity with CEN/TS 18099, ISO/IEC 30107, or ETSI TS 119 461 standards is strongly preferred.
Multi‑Platform Security Knowledge:
Android: Hardware‑Backed Keystore, KeyAttestation, Play Integrity, NDK anti‑tampering, and anti‑Frida controls.
iOS: Secure Enclave, DCAppAttestService, DeviceCheck, AVFoundation security, and jailbreak detection.
Web: Client‑side browser fingerprinting (Canvas, WebGL, AudioContext), WebAssembly, and headless automation detection.
Offensive Security: Proven experience in dynamic instrumentation analysis, memory hooking, and virtual camera injection tools.

Nice To Have Skills

Avenue Code reinforces its commitment to privacy and to all the principles guaranteed by the most accurate global data protection laws, such as GDPR, LGPD, CCPA and CPRA. The Candidate data shared with Avenue Code will be kept confidential and will not be transmitted to disinterested third parties, nor will it be used for purposes other than the application for open positions. As a Consultancy company, Avenue Code may share your information with its clients and other Companies from the CompassUol Group to which Avenue Code’s consultants are allocated to perform its services.

Security Engineer (iOs, Android)

Comece com seu e-mail