Cyber Security Internship - Remote

About the Internship

This internship offers a comprehensive opportunity to engage in authorized security assessments for the HelloGrowthCRM ecosystem including its web application, marketing sites, and associated APIs strictly within defined scopes.

Key daily activities entail conducting penetration tests aligned with the OWASP Top 10 vulnerabilities such as injection attacks, improper access controls, broken authentication and session management, cross-site scripting (XSS), server-side request forgery (SSRF), and misconfiguration issues. Interns will validate multi-tenant data segregation ensuring no unauthorized cross-account access via UI, API, or backend services.

Responsibilities extend to examining authentication, authorisation, and role-based access constraints, actively searching for privilege escalation and insecure direct object references (IDOR). The role involves a thorough review of API security aspects including authentication safeguards, rate limiting, rigorous input validation, and scrutiny of information leakage in error messages.

Interns are expected to operate both automated scanning tools such as Burp Suite, OWASP ZAP, Nikto, and nmap, and perform manual verification to eliminate false positives before reporting. They will also identify security lapses like exposed secrets, ill-configured storage buckets, permissive CORS policies, missing security headers, and dependency vulnerabilities.

A vital part of the internship is compiling detailed vulnerability reports encompassing reproduction steps, corroborating evidence, severity rating via CVSS, business impact analysis, and tailored mitigation strategies. Post remediation, interns will verify fixes, maintain a real-time risk register, and regularly present risk summaries and findings to the founding team.

Additional Information

This is a remote internship requiring full-time commitment, 6 days weekly (Monday through Saturday). All security assessments must adhere to a signed Non-Disclosure Agreement (NDA) and strictly follow written engagement protocols to maintain authorization. Unauthorized testing beyond approved limits will result in immediate termination.

Candidate Eligibility

• Must be willing and able to work remotely for the internship duration.
• Availability to start between August 4 and September 8, 2026.
• Commitment to the full 6-month tenure.
• Possession of required skills and intrinsic interest in cybersecurity.
• Preferred candidates are students pursuing Computer Science Engineering.

Prerequisites and Skills

• Proven practical experience demonstrated by writeups, CTF profiles (such as HackTheBox or TryHackMe), CVEs, or recognized responsible disclosure acknowledgements.
• Familiarity with OWASP Top 10 security risks and OWASP Web Security Testing Guide.
• Comfortable with penetration testing tools like Burp Suite, OWASP ZAP, and nmap, alongside proficiency in at least one scripting language with Python favored.
• Understanding of multi-tenant SaaS environments, REST API structures, and role-based access control models.
• Certifications including CEH, eJPT, OSCP, PNPT, or Security+ are advantageous but not mandatory.
• Requirement to sign an NDA and engagement agreement prior to any testing activities.
• Capacity to dedicate full-time hours six days per week (Monday to Saturday).

Compensation & Perks

• Monthly stipend of INR 5000.
• Flexible scheduling options to suit intern availability.
• Certificate of completion and letter of recommendation upon successful internship completion.

About the Company

The organization specializes in building AI-powered custom accounting and bookkeeping solutions tailored to end-user needs.