Security Analyst / Ad Fraud Researcher

About the role

Pixalate is looking for a Security Analyst / Ad Fraud Researcher to uncover and dismantle fraud schemes targeting mobile apps and Connected TV (CTV). You will treat ad fraud like malware, collecting samples, reverse‑engineering them, and turning insights into detection logic that protects advertisers and platforms.

Key responsibilities

• Analyze Android and iOS apps for hidden ads, ad stacking, click injection, SDK spoofing, background loading and malicious ad SDKs.
• Investigate CTV fraud, including SSAI spoofing, device/app‑bundle spoofing, emulator/bot traffic and fake inventory sold programmatically.
• Perform static and dynamic reverse‑engineering of fraudulent apps, SDKs and botnets, documenting traffic signatures.
• Write detection rules, signatures and indicators for Pixalate’s GIVT and SIVT pipelines and validate them at scale.
• Map the ad supply chain using app‑ads.txt, sellers.json, SupplyChain objects and bid‑stream data to identify resellers and publishers.
• Track threat actors, link campaigns to infrastructure, and monitor underground forums and app stores for new schemes.
• Publish blog posts, threat reports and research briefs; present findings at industry events, webinars and to press.
• Support Customer Success and Sales teams by explaining findings to advertisers, DSPs, SSPs and platforms.

Required profile

• 5+ years in threat research, malware analysis or security analysis at a security vendor, SOC or research lab.
• Hands‑on experience with sandboxing, static and dynamic analysis, and reading decompiled or obfuscated code.
• Strong writing and presenting skills with published technical content.

Required skills

• Android internals and analysis tools: jadx, apktool, Frida, MobSF, Ghidra.
• Network traffic analysis tools: Wireshark, mitmproxy, Burp Suite.
• SQL and Python for large‑scale data analysis.
• Malware analysis techniques: sandboxing, static/dynamic analysis, decompilation.
• Threat‑intel tooling: YARA, VirusTotal, passive DNS, OSINT methods.