OKX - Staff Software Engineer, Mobile Security

• Identify and address security vulnerabilities in mobile code, systems, and networks through manual review, automated tooling, and threat modelling. • Manage and optimise application security tools, processes, and alerts to maintain a strong security posture. • Validate and respond to Bug Bounty submissions, triaging findings and coordinating remediation with engineering teams. • Produce detailed security findings reports and present them to both technical and management audiences, contributing to real-world attack prevention. • Collaborate with development teams to implement and champion secure coding practices across iOS and Android platforms. • Work alongside operations and compliance teams to ensure security is a consistent priority across the organisation. • Participate in incident response and management activities. • Stay current on the latest offensive security techniques, application security threats, and industry best practices. • What We Look For In You • 5+ years of experience in mobile application security or offensive security, with hands-on expertise in iOS and/or Android platforms. • In-depth understanding of security risks, vulnerabilities, and concepts in mobile and web applications. • Proficient in code review across Kotlin, Swift, TypeScript, or JavaScript, with a strong grasp of application security threats. • Able to create proof-of-concepts (PoCs) to demonstrate vulnerabilities, review patch code for adherence to standards, and collaborate with repository owners on remediation. • Actively uses AI tools in your security engineering workflow — including building AI-leveraged workflows and codifying repeatable agent skills so tools like Claude Code or Codex deliver reliably on real production work. • Strong analytical and problem-solving abilities with excellent verbal and written communication skills. • Nice-To-Haves • Nice-To-Haves • Prior experience developing mobile security SDKs at scale — products with a daily active user base of over ten million. • Experience in large-scale business risk control projects, or practical experience in threat intelligence, business risk prevention, and countermeasures against black and grey industries. • In-depth reverse engineering of major apps from first-tier vendors, or other projects that demonstrate strong reverse engineering capabilities. • Proficiency in ARM assembly, with the ability to implement deep-level countermeasures at the native and application layers. • Experience with device fingerprint recognition — including simulating new devices through methods such as flashing, modification, and application cloning. • Ability to work across multiple mobile platforms simultaneously.