Penetration Testing Engineer IV

Overview

IDEMIA Public Security, a division of IDEMIA Group, is the leading provider of secure biometric-based solutions that transform public and private organizations globally. This role offers the opportunity to work on cutting-edge biometric technologies in public security, justice, travel, identity, and access control.

Responsibilities

• Conduct penetration testing for Mobile ID applications (Android and iOS).
• Perform security assessments for Digital Identity Wallet and Civil Identity backend systems and APIs.
• Test AWS cloud infrastructure security controls and mobile SDK integrations.
• Evaluate biometric authentication systems, liveness detection, and PKI implementations.
• Conduct network penetration tests and social engineering assessments.
• Develop detailed vulnerability reports and collaborate on remediation.
• Participate in threat modeling sessions and maintain testing tools.

Qualifications

Required Technical Skills: Mobile Application Security Testing (iOS and Android using Frida, Objection, MobSF), Identity & Authentication Security (biometric assessments, PKI, OAuth, SAML, JWT), Cloud Security Assessment (AWS testing methodologies, Container and Kubernetes security), General Penetration Testing (Nmap, Metasploit, Burp Suite, social engineering, web security).

Required Certifications: OSCP is required. Additional certifications such as CISSP, CEH, GWEB, or GMOB are preferred.

Experience: Minimum 5 years in penetration testing, mobile application security testing, government or regulated systems testing, and identity management.

Desired Skills: Knowledge of digital identity standards, government identity verification, secure SDLC, privacy regulations (SOC2, GDPR, CCPA), and threat intelligence.

Compensation

The US base salary range for this position is $93,440 - $116,813 plus bonus and benefits, determined by skills, experience and education.

Key skills/competency

• Penetration Testing
• Mobile Security
• Cloud Security
• Network Testing
• Biometrics
• PKI
• API Security
• Vulnerability Reporting
• Threat Modeling
• Social Engineering