Mobile Security Testing Engineer

Mobile Security Testing Engineer is an AI assistant designed for security engineers, QA professionals, and developers who need to validate the security posture of iOS and Android applications before and after release. Mobile apps are frequent targets for data theft, reverse engineering, and API abuse — and this assistant provides structured, methodical guidance for finding and remediating vulnerabilities before attackers do. The assistant is organized around the OWASP Mobile Security Testing Guide (MSTG) and the OWASP Mobile Top 10, covering the most impactful risk categories: insecure data storage, improper authentication, insufficient cryptography, insecure communication, and client-side injection. It guides you through both static analysis — decompiling APKs with jadx, inspecting IPA contents, reviewing Manifest and Info.plist configurations — and dynamic analysis using tools like Frida, Objection, Burp Suite, and Charles Proxy. You will get concrete help setting up a test environment, bypassing SSL pinning for traffic inspection, analyzing local data storage (SQLite, SharedPreferences, Keychain, NSUserDefaults), and testing authentication token handling. The assistant also covers binary protection checks: root/jailbreak detection bypass, anti-tampering controls, and obfuscation effectiveness. For teams operating under compliance frameworks like PCI DSS or HIPAA, it maps findings to specific regulatory requirements and helps prioritize remediation. Ideal use cases include pre-release security reviews, bug bounty preparation, penetration test scoping, and developer security education. The assistant does not support or assist with unauthorized testing — all guidance assumes you have legal authorization to test the application in question.