FinTech InfoSec Intern: VAPT, DevSecOps & Compliance

Tabby | تابي; Riyadh; On-site; SAR 27,900 - 50,220; Full time

Benefits offered by this job

Paid internship

Office-based in Riyadh

Mentorship and growth

Job summary

Tabby is seeking a paid Information Security intern to join the GRC and risk tracks. You will work with risk, engineering, and security teams across SAST/DAST tooling, vulnerability management, and compliance.

Office-first in Riyadh with possible international coordination. Open to students and fresh graduates, full‑time engagement, with a clear path to junior Information Security roles based on performance.

Qualifications

• Solid understanding of information security fundamentals (confidentiality, integrity, availability) and OWASP Top 10.
• Understanding of HTTP, TLS, DNS and TCP/IP fundamentals.
• Knowledge of authentication/authorization patterns (OAuth 2.0, JWT).
• Familiarity with Linux command line and POSIX environments.
• Ability to read technical material and explain it clearly in writing.
• Experience with Git and standard development workflows.

Responsibilities

• Triage findings from SAST/DAST/SCAs and dependency scanners across repos.
• Reproduce and document vulnerabilities; write remediation tickets for teams.
• Contribute to secure code reviews on selected merge requests.
• Participate in threat modelling and write-ups for new features.
• Run scoped assessments in staging with senior sign-off.
• Maintain security tooling and dashboards; triage false positives.
• Assist with security checks during release cycles.
• Contribute to DevSecOps, CI/CD gates, and container image scanning.
• Engage in incident response exercises with senior engineers.
• Collaborate with SOC for logging and alert triage.

Skills

InfoSec fundamentals

Networking basics

OAuth 2.0 / JWT

Linux command line

Reading technical material

Git workflows

English communication

Python or Go (Strong plus)

CTF participation

Burp Suite / ZAP

Vulnerability scanners / SAST/SCA

Mobile app security basics

Container security basics

Bug bounty experience

DevSecOps tooling

SIEM / SOC exposure

SQL basics

Cryptography fundamentals

Tools

Burp Suite

OWASP ZAP

Nessus

OpenVAS

Trivy

Grype

Semgrep

CodeQL

Snyk

Docker security

Kubernetes security

Job description

Tabby is seeking a paid Information Security intern to join the GRC and risk tracks. You will work with risk, engineering, and security teams across SAST/DAST tooling, vulnerability management, and compliance.

Office-first in Riyadh with possible international coordination. Open to students and fresh graduates, full‑time engagement, with a clear path to junior Information Security roles based on performance.