Security Engineer Intern

Security engineer intern at Fam Bengaluru, breaking the app before attackers do - application security on a live consumer payments product.

This Bengaluru internship was posted on 23 September 2026. The listing seeks a security enthusiast who thinks like a hacker but works for the good guys, as an application security engineer intern and first line of defense for Fam. Requirements include a deep understanding of the OWASP Top 10 for web and mobile, knowing how to exploit and patch common vulnerabilities, and hands-on experience with tools like Burp Suite, Metasploit, Nmap, Postman or similar open-source security tools.

About Fam

Fam (previously FamPay) describes itself as India's first payments app for everyone above 11. FamApp supports online and offline payments through UPI and the FamCard, with a stated mission of raising a financially aware generation and reaching 250 million+ young users in India. Per its listings, the company was founded in 2019 by IIT Roorkee alumni.

Fam is based in Bengaluru and hires across engineering, product, design, security and operations roles, per its listings. Learn more on Fam's website.

The role in plain terms

This is a real application-security internship, not a shadow-the-team program: the listing frames the intern as a first line of defense on a payments product, where vulnerabilities have financial consequences. The requirements are concrete and testable - OWASP Top 10 exploitation and patching, Burp Suite and friends - so self-taught security practice (CTFs, labs, bug bounty) maps directly onto what they ask.

The team and the work

Per the listing, the product is a consumer payments app on UPI rails, so the security surface includes mobile app, APIs and payment flows. Founded in 2019, the company is young and the security team is likely small, meaning real exposure for an intern.

What the employer asks for

These requirements are quoted from the employer's listing, kept in their exact words so eligibility details are not distorted:

• The Hacker Mindset: You have a deep understanding of the OWASP Top 10 (Web & Mobile) and know how to exploit and patch them.
• Tool Wizardry: Hands-on experience with tools like Burp Suite , Metasploit , Nmap , Postman , or similar open-source security tools.
• Coding Chops: You can read code (Python, Go, Java, or JavaScript) and write scripts to automate attacks or defenses.
• Curiosity: You are a student of the game. You actively participate in CTFs , Bug Bounties , or have a rank on platforms like HackTheBox/TryHackMe.
• Communication: You can explain a complex vulnerability to a developer without sounding like a robot.
• Bonus Points
• Experience with Cloud Security (AWS/GCP).
• A Hall of Fame mention in any major tech company's Bug Bounty program.

Who this role suits

Students or fresh graduates with hands-on security practice - OWASP, Burp Suite, CTFs or bug bounties - who want application security on a real fintech product. Not for candidates whose security exposure is coursework-only; the listing expects working tool knowledge.

Practical notes

For security internships, expect practical questions: how you would test a login flow, what a given vulnerability class looks like, tool usage. A CTF track record or disclosed reports are the strongest credentials at this level.

Working at Fam

Work at Fam spans consumer payments on UPI rails, card products, and the infrastructure behind a high-volume consumer fintech app.

How to apply

Apply directly on the employer's site: Security Engineer Intern at Fam. We found this listing on the Lever public postings feed (jobs.lever.co), where it was posted on 23 Sep 2026 and was still open when we checked on 30 Oct 2026. Before applying, re-read the employer's own description in full, since eligibility details, deadlines and process steps can change at any time and the employer's page is always the final word. Tailor your resume to the specific requirements above rather than sending a generic one: mirror the skills and tools the listing names where you genuinely have them. A short, specific note on why this team and this problem interest you goes further than a long generic cover letter. Never pay a fee to apply or interview; genuine employers, including this one, do not charge candidates.

Related openings on GetFirstJob

If this role is not the right fit, these current openings are in a similar area:

• Senior Information Security Risk Analyst at Fam
• Product Manager at Fam
• Senior Database Administrator at Fam

We write and maintain this page from the employer's public listing and link straight to their application page. We do not act as a recruiter, and applying is always free. If the link above stops working, the role has likely been filled.