Principal Security Engineer

About The Opportunity Responsible for leading the security gap analysis, threat modeling, and remediation architecture across Mitek's i OS, Android, and Web capture layers to achieve CEN/TS * certification readiness.
This engineer (or specialized group covering i OS, Android, and Web) will evaluate current signal collection against modern injection attacks (unnamed virtual camera drivers, OS-level hooks, frame injection), map existing controls to ETSI TS * / e IDAS 2.0 standards, and define technical remediation specifications.
They will guide SDK implementation developers, conduct security code reviews, and simulate dynamic injection attacks (Frida, virtual camera drivers) to validate that closed gaps meet certification-grade rigor.
Responsibilities Standards Mapping & Gap Analysis: Perform control-by-control security reviews against CEN/TS * and ETSI TS * requirements across i OS, Android, and Web capture pipelines.
Architecture & Signal Specification: Design non-spoofable hardware attestation patterns (Android Keystore / i OS Secure Enclave), secure frame chain-of-trust mechanisms, and temporal cross-frame sensor correlation protocols.
Web Anti-Fraud Strategy: Define browser fingerprinting, anti-automation (Puppeteer/Playwright detection), and hardware/Web GL probing mechanisms to identify virtual webcams while remaining privacy-compliant.
Developer Guidance & PR Reviews: Translate security findings into precise engineering specs for Android, i OS, and Web developers, assisting in code reviews and pull-request security evaluations.
Adversarial Validation: Simulate dynamic injection attacks (unnamed virtual camera drivers, OS-level hooks, Frida/Xposed dynamic instrumentation) to validate that remediation measures close identified vulnerabilities without driving up false rejection rates.
SOW Requirement Coverage SOW Requirements *** (Project 1 Discovery): Delivers the control-by-control CEN/TS * gap analysis, root-cause assessment of false rejections/signal staleness, candidate signal evaluation across i OS/Android/Web, and the finalized Project 2 remediation roadmap.
SOW Requirements * (Architecture & Guidance): Architecturally defines implementation specifications for Android Keystore / i OS Secure Enclave attestation, frame integrity chains, cross-frame sensor correlation, browser fingerprint expansion, and C++ check consolidation.
Risk Mitigation Identifies design flaws early and guarantees security controls meet third‐party evaluation lab criteria prior to code freeze, mitigating certification audit failure.
Required Qualifications Domain Expertise: Deep background in mobile and web security, anti‐fraud, or biometric liveness defenses.
Direct familiarity with CEN/TS *, ISO/IEC *, or ETSI TS * standards is strongly preferred.
Multi‐Platform Security Knowledge: Android: Hardware‐Backed Keystore, Key Attestation, Play Integrity, NDK anti‐tampering, and anti‐Frida controls.
i OS: Secure Enclave, DCApp Attest Service, Device Check, AVFoundation security, and jailbreak detection.
Web: Client‐side browser fingerprinting (Canvas, Web GL, Audio Context), Web Assembly, and headless automation detection.
Offensive Security: Proven experience in dynamic instrumentation analysis, memory hooking, and virtual camera injection tools.
Nice To Have Skills Avenue Code reinforces its commitment to privacy and to all the principles guaranteed by the most accurate global data protection laws, such as GDPR, LGPD, CCPA and CPRA.
The Candidate data shared with Avenue Code will be kept confidential and will not be transmitted to disinterested third parties, nor will it be used for purposes other than the application for open positions.
As a Consultancy company, Avenue Code may share your information with its clients and other Companies from the Compass Uol Group to which Avenue Code's consultants are allocated to perform its services.
#J-*-Ljbffr