About the Role
Reward360's InfoSec team is looking for an Application Security & VAPT Intern to support offensive security testing across our web, API, and cloud-hosted rewards and loyalty platforms. This is a hands-on offensive security role you will work directly under the Lead Application Penetration Tester on real assessments, contributing to vulnerability assessments, penetration tests, and secure code review ahead of release management.
Key Responsibilities
• Perform manual and tool-assisted web application and API penetration testing aligned to the OWASP Top 10 and OWASP API Security Top 10.
• Support network and infrastructure VAPT engagements with host/service enumeration, misconfiguration checks, and exploitation in authorized scopes.
• Assist in secure code review and SAST/DAST/SCA triage integrated into the CI/CD pipeline, distinguishing exploitable findings from noise.
• Document findings with clear proof-of-concept, CVSS scoring, business risk framing, and actionable remediation guidance.
• Support cloud security reviews across AWS services (EC2, EKS, S3, IAM, WAF, ALB) for misconfigurations and excessive privilege.
• Contribute to threat modelling exercises followed by frameworks for new features and architecture changes.
• Stay current on emerging attack techniques, CVEs, and vendor advisories relevant to R360's tech stack.
Required Skills & Knowledge
• Solid grasp of the OWASP Top 10, OWASP API Security Top 10, and common web/API attack classes (SQLi, XSS, IDOR, SSRF, auth/authz bypass, mass assignment).
• Working knowledge of HTTP/TCP-IP fundamentals, authentication mechanisms (JWT, OAuth2, SAML), and Linux command-line usage.
• Hands-on exposure to Burp Suite (Community/Pro) and at least one of: OWASP ZAP, Nmap, SQLMap, Metasploit.
• Familiarity with Python or Bash for scripting and automating repetitive testing tasks.
• Ability to write clear, structured vulnerability reports: finding, impact, evidence, and remediation.
• An attacker mindset: curiosity to break things safely, and the discipline to document how.
Good to Have
• Exposure to Active Directory attack paths (Kerberoasting, ACL abuse, Pass-the-Hash) or basic Windows/Linux privilege escalation.
• Familiarity with SAST/DAST/SCA tooling (Semgrep, Snyk, Trivy, Nuclei) or CI/CD pipeline security integration.
• Basic AWS knowledge (IAM, S3, EC2, security groups) or container/Kubernetes security fundamentals.
Eligibility
• Graduates in any field
• Available for a 6-month full-time internship based in Bangalore.(Work From Office)