Information Security Intern — VAPT/GRC Track

تابي; Riyadh; Hybrid; SAR 33,480 - 50,220; Full time

Job summary

Tabby is seeking an Information Security Intern to join the InfoSec GRC team in Saudi Arabia. The role spans two tracks: VAPT and Governance, Risk & Compliance, with embedded responsibilities across secure coding, threat modelling, policy control frameworks, and security awareness.

The internship offers hands-on experience on production tasks, security tooling, and collaboration with risk engineers, platform/SRE, and product teams.

Qualifications

• Solid understanding of information security fundamentals and typical control categories (confidentiality, integrity, availability).
• Familiarity with HTTP, TLS, DNS and TCP/IP concepts.
• Understanding of authentication/authorization patterns (sessions, cookies, OAuth 2.0, JWT).
• Proficiency with Linux command line and POSIX environments.
• Ability to read technical material and document it clearly in writing.
• Experience with Git and standard development workflows.
• English sufficient for documentation and team communication.

Responsibilities

• Work on real production tasks under senior review.
• Support vulnerability assessment and remediation in collaboration with engineers.
• Contribute to secure code reviews for selected merge requests.
• Participate in threat modelling sessions for new features.
• Assist in incident response exercises and SOC-related activities.
• Assist with policy and control framework documentation in GRC track.

Skills

InfoSec fundamentals

OWASP Top 10

HTTP/TLS/DNS knowledge

Auth patterns (OAuth 2.0, JWT)

Linux CLI

Git workflows

English documentation

Tools

Burp Suite

OWASP ZAP

Nessus

OpenVAS

Trivy

Grype

Semgrep

CodeQL

Snyk

Docker

Kubernetes

Job description

Tabby is seeking an Information Security Intern to join the InfoSec GRC team in Saudi Arabia. The role spans two tracks: VAPT and Governance, Risk & Compliance, with embedded responsibilities across secure coding, threat modelling, policy control frameworks, and security awareness.

The internship offers hands-on experience on production tasks, security tooling, and collaboration with risk engineers, platform/SRE, and product teams.