Information Security📣 Job Ad

About the Information Security Internship

Tabby, a company that develops financial products used by millions across the GCC, is offering a paid Information Security internship in Riyadh, Saudi Arabia. This role is designed for early-career engineers with 0-1 years of experience who are seeking to grow as security practitioners within a regulated fintech environment. The internship provides real engineering responsibilities within high-load, security-critical systems that operate under strict regulatory requirements.

The Information Security Function at Tabby

The Information Security function is responsible for protecting Tabby's operations across mobile applications, backend services, payment integrations, and cloud infrastructure. The team collaborates closely with product engineering, risk engineering, and platform/SRE teams. This internship covers two complementary tracks: Vulnerability Assessment & Penetration Testing (VAPT) and Governance, Risk & Compliance (GRC). Candidates apply once and are matched to the most suitable track during the interview process.

General Internship Responsibilities

Interns are fully integrated into the security team and work on production tasks under senior review. This is an engineering role with direct responsibilities. Responsibilities common to both tracks include:

• Collaborating with risk and platform engineers on PII handling, secrets management, and encryption reviews.
• Contributing to the internal security knowledge base, including runbooks, playbooks, and awareness content.

Vulnerability Assessment & Penetration Testing (VAPT) Track

Interns on the VAPT track will focus on application security testing, security architecture reviews, and incident response. Specific responsibilities include:

• Triaging findings from SAST, DAST, SCA, and dependency scanners across mobile and backend repositories.
• Reproducing and documenting vulnerabilities; writing remediation tickets for product teams.
• Contributing to secure code reviews on selected merge requests (*, authentication, input validation, data handling).
• Participating in threat-modeling sessions for new features and producing write-ups.
• Running scoped assessments against staging environments under senior sign-off.
• Assisting with the maintenance of security tooling, including scanner configurations, baseline rules, dashboards, and false-positive triage queues.
• Supporting security checks during release cycles.
• Contributing to DevSecOps initiatives, such as security gates in CI/CD pipelines and dependency/container image scanning.
• Gaining exposure to logging, monitoring, and alert triage workflows alongside the Security Operations Center (SOC).
• Participating in incident response exercises and post-mortems with senior engineers.

Governance, Risk & Compliance (GRC) Track

Interns on the GRC track will support compliance programs, risk assessments, and security awareness initiatives. Specific responsibilities include:

• Supporting compliance programs against frameworks like PCI DSS, ISO 27001, and SAMA, including evidence collection, control mapping, and gap analysis.
• Assisting with the maintenance of security policies, standards, and procedures across domains such as access control, cryptography, asset management, change management, third-party security, vulnerability management, and awareness and training; tracking owners and review cycles.
• Contributing to risk assessments, including risk registers, control testing, and treatment plans.
• Supporting vendor and third-party security assessments.
• Helping prepare for internal and external audits, including workpapers, evidence packages, and response coordination.
• Contributing to security awareness content, training rollouts, and metrics tracking.
• Working alongside engineering teams to translate policy requirements into concrete technical controls.

Internship Format and Expectations

This internship offers full integration into Tabby's Information Security team, which is a distributed engineering team operating across multiple countries. While an office-first presence in Riyadh is preferred where possible, the location offers flexibility, and candidates may be based outside KSA. A full-time level of engagement is expected throughout the internship, with understanding for occasional flexibility needed for classes or exams, which can be aligned with the mentor in advance.