Contract Senior Mobile Engineer — Pre-Launch Code Review, Reliability & Security Hardening (with Team Training)
Job type: Contract, project-based (fixed scope) Location: Remote (US-based or US work authorization required) Duration: Approximately 5–7 weeks Compensation: $100–$150/hour DOE, or fixed project bid (estimated 110–160 hours).
Milestone-based payment — see below.
About the App
We're a large healthcare company launching a new startup creating mobile study apps (iOS and Android) that helps nurses prepare for their certification exams. The app includes:
- A practice test engine with a large question bank
- A short-form video library
- Study games to reinforce learning
- Progress tracking that records which questions each user gets right and wrong
- Subscription-based access to content
The app is fully built and nearing pre-launch; it has not yet been submitted to the App Store or Google Play. It was built by a small team using AI-assisted development (Claude Code) in TypeScript, using React Native with Expo. The team is not made up of professional engineers, which is why we need you.
A second app for a different exam is planned, using the same codebase but with a different question and video library, so we need a foundation that supports both.
What We Need
We need an experienced senior engineer to review the entire app and make it deployment-ready. Our priorities, in order:
- Reliability. No single bug should be able to take the app down for our user base. Customers must always be able to log in and access what they paid for.
- Payments that work and comply. Subscriptions must be implemented correctly, securely, and in compliance with App Store and Google Play billing rules.
- Security. Nobody should be able to use the app without paying, access another user's data, bulk-extract our content, or take control of our product or infrastructure.
- Code quality. The codebase should be clean and maintainable enough that our team can safely add features after you leave.
Just as importantly, you'll teach as you go. Our team members built this app with heavy AI assistance and will maintain it after the engagement. Knowledge transfer is a core deliverable.
Scope of Work
Phase 1 — Full Review & Written Assessment (weeks 1–2)
- Complete manual code review: structure, dead/duplicated code, error handling, maintainability
- Reliability review: crash risks, unhandled errors, behavior when the backend or network is unavailable, single points of failure, logging and crash reporting
- Data integrity review: confirm user progress and question history are stored safely, cannot be corrupted by bugs, and are backed up with a tested recovery process
- Payment & subscription review: how subscriptions are implemented; compliance with Apple/Google in-app purchase requirements; server-side receipt/entitlement validation; what happens on renewal, cancellation, refund, and app reinstall
Security review:
- Paywall enforcement on the server for every content endpoint, not just in the app UI
- Access control between users (no user can reach another user's data by manipulating requests)
- Secrets and API keys — nothing sensitive embedded in the app bundle where it can be extracted
- Admin and infrastructure access — how content is managed and who can reach production; risk of account or infrastructure takeover
- General OWASP Top 10 / OWASP Mobile Top 10 pass; dependency vulnerabilities
- Content protection: how easily one subscriber could bulk-download the question bank or video library
- Video delivery review: how videos are stored, served, and secured; projected cost and performance at scale (thousands to hundreds of thousands of users)
- App store readiness: review guideline compliance, privacy policy and data disclosures, permissions, build and signing setup
- Two-app architecture assessment: how to structure the codebase to support a second content-swapped app
Deliverable: a written report with findings rated Critical / High / Medium / Low, in language a non-technical founder can follow, with recommended fixes and a scope estimate for Phase 2. We review this report and approve Phase 2 before it begins.
Phase 2 — Remediation (weeks 2–5)
- Fix all Critical and High findings directly in the codebase
- Refactor the highest-impact code quality and reliability issues (prioritized with us — not a full rewrite)
- Implement caching/performance improvements for content and video delivery as identified
- Set up crash reporting, basic monitoring/alerting, and backup verification
All changes are delivered as pull requests with clear explanations.
Phase 3 — Verification, Launch Support & Handoff (weeks 5–7)
- Retest all remediated findings
- Support test builds (TestFlight / Play internal testing) and first app store submission
- Final report: what was found, what was fixed, what remains, and what to watch going forward
- Complete training deliverables
Training & Knowledge Transfer (throughout the engagement)
Our team member who built the app will shadow your process. You will:
- Hold walkthrough sessions (roughly weekly) explaining your findings and reasoning
- Provide ongoing mentorship — our developer may pair with you on selected fixes and ask questions throughout
- Deliver written documentation: the app's architecture, its security and payment model, and a "pre-release checklist" for future changes
Record walkthrough videos of the major review and fix work so the material can be revisited
Candidates should genuinely enjoy teaching. If explaining your work to a less-experienced developer sounds like a distraction, this isn't the right engagement.
Payment Structure
Milestone-based: Phase 1 is paid on delivery of the written assessment; Phase 2 is scoped and approved from that report before it starts; Phase 3 is paid on completion of retesting and handoff. Hourly candidates should expect weekly time reporting.
Required Qualifications
- 5+ years of professional software engineering experience, including production TypeScript
- Hands-on experience shipping mobile apps to the App Store and Google Play using React Native with Expo
- Experience implementing mobile subscriptions (StoreKit / Google Play Billing, or RevenueCat or similar) with server-side entitlement validation
- Backend experience: APIs, databases, authentication, backups and recovery
- Application security experience: secure code review, OWASP Top 10, server-side authorization; able to both find and fix issues
- Experience preparing apps for scale: caching, media/CDN delivery, performance testing
- Clear communicator with demonstrated mentoring or training experience
Preferred Qualifications
- Security certifications (OSCP, OSWE, GWAPT) or professional AppSec work history
- Experience reviewing or hardening AI-generated codebases
- Experience with video streaming/short-form media apps
- Experience with edtech, exam prep, or quiz-based products
- Familiarity with current App Store external-purchase-link rules for US apps
How to Apply
Please include a Cover Letter including:
- Links to 1–2 apps you've shipped to the App Store or Google Play (or a description if under NDA)
- A brief summary of a comparable engagement where you reviewed and hardened an existing codebase
- One example of a security or reliability issue you found in a real app and how you fixed it
- A few sentences on how you approach mentoring less-experienced developers
- Your rate (hourly or fixed bid for the scope above) and availability
Note: Finalists will sign an NDA before receiving codebase access. All testing is performed against a development/staging environment. The app does not handle patient or health data — it is exam-prep content only.
Pay: $100.00 - $150.00 per hour
Work Location: Remote
