Fam, previously known as FamPay, is accepting applications for a Security Engineer Intern in Bengaluru. Jobsii checked its official Lever vacancy, application form and linked challenge page on 3 October 2026. This is a full-time, onsite internship at Fam headquarters, not a remote opportunity. The employer confirms a competitive stipend but does not disclose the amount. Candidates should have practical application-security skills and be ready to explain vulnerabilities, their impact and appropriate fixes to an engineering team.
The position sits within Engineering and focuses on application security. The vacancy identifies Bengaluru as the location and explicitly states that interns work onsite at Fam HQ. No hybrid arrangement, working-day schedule, relocation allowance or accommodation support is published. The description discusses protecting payment applications and working with engineers, rather than a general IT-support assignment. Applicants considering a move should clarify office attendance, daily hours and relocation arrangements directly with the hiring team before accepting an offer.
Fam asks for a deep understanding of the OWASP Top 10 for web and mobile applications. Hands-on familiarity with security tools such as Burp Suite, Metasploit, Nmap, Postman or comparable open-source tools is requested. Candidates should be able to read code in Python, Go, Java or JavaScript and write automation scripts. The posting also seeks active participation in CTFs, bug-bounty programs or platforms such as HackTheBox and TryHackMe, alongside the ability to explain technical findings clearly.
The official description does not state a compulsory degree, academic percentage, graduation batch, age limit or minimum number of professional experience years. That absence is not a promise that every applicant will be shortlisted. Relevant technical evidence remains important. Cloud-security experience with AWS or GCP, a major company's bug-bounty Hall of Fame mention and open-source security contributions are listed as bonus points. Applicants should distinguish these desirable credentials from the core application-security capabilities instead of treating every bonus item as mandatory.
The role covers vulnerability assessment and penetration testing for web applications, Android and iOS applications, and APIs. Interns would help integrate static and dynamic security tools into development pipelines, review source code, validate incoming bug-bounty reports and prioritize fixes. Threat modeling with product and engineering teams is also included. The employer mentions keeping up with vulnerabilities and security trends. These duties belong within the employer's authorized environment; the vacancy is not permission to probe unrelated systems or financial accounts.
Fam lists a competitive stipend, a certificate, a letter of recommendation, a friendly leave policy and company merchandise among the internship perks. No numerical stipend, payment schedule, bonus structure or benefit conditions are provided. Jobsii therefore does not attach an invented monthly salary to this article. The description also does not publish a fixed internship duration, joining date, application deadline, vacancy count or guaranteed permanent conversion. Ask for written clarification of these terms before relying on an expected income or committing to a move.
The application form asks how long you are available and offers choices from two through six months. These are applicant-availability options, not a statement that everyone receives a six-month internship or can freely choose the final engagement length. The form also asks when you can join, whether you are currently in college, your college year and institution, prior internship experience, and willingness to relocate to Bangalore. Answer based on your real availability and academic obligations; discuss the agreed duration with the recruiter.
Open the official vacancy and follow its application link. The live form requests a resume, full name, email, phone number, current location and current company, along with a LinkedIn URL. Optional link fields include GitHub, a portfolio and other websites. Explain what excites you about Fam and complete the availability and relocation questions. If a required field does not fit your situation, answer truthfully or seek clarification rather than inventing employment history. Review every field before submitting and retain any confirmation the portal provides.
The vacancy instructs candidates to apply and complete the challenge linked at ctf.fampay.co. During Jobsii's check, that address loaded a generic CTF platform landing page without a publicly visible challenge list. We could verify the link and the employer's instruction, but not the complete participant-access or submission workflow. Ask the hiring team how to access the recruitment challenge if it is not available when you visit. Do not assume that submitting a resume alone completes the requested process, or that the challenge has been waived.
The following guidance is independent Jobsii editorial advice, not Fam's published interview process or extra eligibility criteria. Select a small number of permitted projects that show both diagnosis and remediation. Explain the affected feature, expected behavior, observed problem, potential impact and proposed correction. Use sanitized examples from your own labs, authorized programs or approved coursework. Remove credentials, personal information and confidential reports. A useful portfolio demonstrates judgment and clear reasoning without exposing another organization's systems or bypassing its disclosure rules.
Practice turning a technical observation into a concise report. Separate the evidence you actually observed from assumptions about possible impact. Explain the fix at the design or code-review level and how an authorized team could confirm that the problem is resolved. Include limitations when you cannot establish severity reliably. Avoid presenting a tool's automated output as a fully validated finding. These habits can help communicate your existing experience, but Jobsii has no evidence of a specific interview test, required certification or guaranteed selection strategy.
Keep resume claims consistent with portfolio links, public contributions and any disclosed CTF achievements. Say what you personally did in a team project, and do not publish private flags, restricted challenge solutions or confidential bounty correspondence. Check that links are readable without unexpected permission requests. Prepare a realistic availability statement covering college attendance, examinations and relocation. Because the work is onsite, a remote-only applicant should clarify flexibility with Fam rather than assuming that an online application implies work-from-home eligibility.
The official application form was accessible on the verification date, but the employer can close or change the vacancy later. Recheck the listing when applying, confirm the undisclosed stipend amount and agreed duration, and resolve access to the linked CTF step. Jobsii provides an informational guide; applications and hiring decisions remain with Fam. Use the official links below rather than an unofficial recruiter claiming a guaranteed placement.
Review the role details, deadline, and work mode before applying. Jobsii tracks the apply action so candidates can keep application history inside their dashboard.
