Cyber Security - Internship (WFH)

About the internship:Selected intern's day-to-day responsibilities include:

1. Perform authorised security testing on the HelloGrowthCRM web application, marketing website, and APIs - strictly limited to systems we authorise in writing

2. Run web application penetration tests covering the OWASP Top 10: injection, broken access control, authentication and session flaws, XSS, SSRF, and security misconfiguration

3. Test multi-tenant isolation - verify that one customer account cannot read or modify another customer's data through the UI, the API, or any backend endpoint

4. Test authentication, authorisation, and role-based access control across every user role; hunt for privilege escalation and IDOR issues

5. Review API security: authentication, rate limiting, input validation, and information disclosure in error responses

6. Run automated scans (Burp Suite, OWASP ZAP, Nikto, nmap) and manually verify every finding so no false positives reach the engineering team

7. Check for exposed secrets, misconfigured storage buckets, permissive CORS, missing security headers, and vulnerable dependencies

8. Write clear vulnerability reports with reproduction steps, evidence, CVSS severity, business impact, and a specific remediation recommendation

9. Retest fixes after engineering ships them, confirm closure, and maintain a running risk register

10. Present a weekly summary of findings, risk trends, and priorities to the founding team

Note: This is a full-time remote internship, 6 days a week (Monday to Saturday). All testing is performed under a signed NDA and written rules of engagement.Who can apply:Only those candidates can apply who:are available for the work from home job/internshipcan start the work from home job/internship between 16th Oct'26 and 20th Nov'26are available for duration of 6 monthshave relevant skills and interestsare Computer Science Engineering studentsStipend:INR₹ 5,000 /monthDeadline:[hidden]:59:59Other perks:Certificate, Letter of recommendationSkills required:Python, Computer Networking, Linux, Ethical Hacking, VAPT, Web Application Security, Burp Suite and OWASP Top 10Other Requirements:1. Demonstrable hands-on experience - share writeups, CTF profile (HackTheBox/TryHackMe), CVEs, or responsible-disclosure acknowledgements2. Working knowledge of the OWASP Top 10 and the OWASP Web Security Testing Guide3. Comfortable with Burp Suite, OWASP ZAP, nmap, and at least one scripting language (Python preferred)4. Understanding of multi-tenant SaaS architectures, REST APIs, and role-based access control5. Certifications such as CEH, eJPT, OSCP, PNPT or Security+ are a plus but not required6. Must sign an NDA and written rules of engagement before any testing begins; testing outside the authorised scope will end the internship immediately7. Can commit full-time, 6 days a week (Monday to Saturday)About Company:We are developing custom accounting and bookkeeping software for end users using AI technologies.

Responsibilities

Selected intern's day-to-day responsibilities include:

1. Perform authorised security testing on the HelloGrowthCRM web application, marketing website, and APIs - strictly limited to systems we authorise in writing

2. Run web application penetration tests covering the OWASP Top 10: injection, broken access control, authentication and session flaws, XSS, SSRF, and security misconfiguration

3. Test multi-tenant isolation - verify that one customer account cannot read or modify another customer's data through the UI, the API, or any backend endpoint

4. Test authentication, authorisation, and role-based access control across every user role; hunt for privilege escalation and IDOR issues

5. Review API security: authentication, rate limiting, input validation, and information disclosure in error responses

6. Run automated scans (Burp Suite, OWASP ZAP, Nikto, nmap) and manually verify every finding so no false positives reach the engineering team

7. Check for exposed secrets, misconfigured storage buckets, permissive CORS, missing security headers, and vulnerable dependencies

8. Write clear vulnerability reports with reproduction steps, evidence, CVSS severity, business impact, and a specific remediation recommendation

9. Retest fixes after engineering ships them, confirm closure, and maintain a running risk register

10. Present a weekly summary of findings, risk trends, and priorities to the founding team

Note: This is a full-time remote internship, 6 days a week (Monday to Saturday). All testing is performed under a signed NDA and written rules of engagement.