Android App Security Audit

I am looking for a seasoned ethical hacker who can run a full-scale security audit on our production Android application. The engagement is limited to the mobile layer—no web services or network infrastructure need testing—so every effort should focus on uncovering weaknesses that an attacker could exploit directly from the APK or through device interaction.

Scope of work
• Static analysis of the APK (decompilation, code review, dependency inspection).
• Dynamic testing on real or emulated devices, including runtime manipulation, traffic interception, and permission abuse checks.
• Alignment with OWASP MASVS and OWASP Mobile Top 10 to be sure we are covering the industry-standard attack surface.
• Verification of secure storage, authentication flows, cryptographic use, and inter-app communication.
• A re-test after patches, to confirm vulnerabilities are fully closed.

Deliverables
1. A concise executive summary (non-technical) spotlighting overall risk posture.
2. A detailed technical report that lists every finding, reproduction steps, impact rating, and practical remediation guidance.
3. Proof-of-concept screenshots, scripts, or videos for critical issues.
4. Signed attestation that all tooling (Burp Suite, MobSF, Frida, ADB, etc.) and data collected during testing will be deleted or returned after project close.

Acceptance criteria
• At least 90 % MASVS controls assessed.
• No critical or high-severity issues remain open in the re-test.
• All documentation delivered in editable format (DOCX or Markdown) plus PDF.

Please let me know your estimated timeline, the primary tools you prefer to use, and any prior Android app audit experience relevant to the scope.