Intake open · 3-month track

Application Security and DevSecOps Internship

This application security internship teaches you to catch problems before code ships: review code, scan dependencies and put security checks into the CI pipeline that every pull request passes through.

Apply now See the 12-week plan
3Months
HybridFormat
Lab-basedTraining
PKR 5,000Total fee
CI security checks. Lab
# every pull request
sast = scan(code)
deps = audit(packages)
Checks passing9 / 10
commit 1commit 40
Ends as
A secured pipeline
Mentor review
Weekly, 1-to-1
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
  • SAST
  • DAST
  • OWASP ZAP
  • GitHub Actions
  • Secure code review
  • Dependency scanning
12Weeks
25 hrsPer week
4Graded deliverables
1Secured pipeline
The work

Fixing it before release costs far less than fixing it after

Most security issues start as ordinary code. Application security is about catching them in review and in the pipeline, before customers ever see them. That is what the twelve weeks train.

  • 1You get a real codebase and its CI pipeline
  • 2You review code against secure coding practice
  • 3Your mentor challenges every finding and every fix
  • 4You add automated checks so the issue cannot return

You should already write code in at least one language. Secure coding basics are covered in weeks 1 to 3.

.github/workflows/security.yml
# Week 8: security checks on every pull request
name: security
on: [pull_request]
jobs:
  checks:
    steps:
      - name: Static analysis (SAST)
      - name: Dependency audit
      - name: OWASP ZAP baseline (DAST)
      # fail the build on high severity
Skills

What you will be able to do after this application security internship

01

Secure code review

Spotting risky patterns in a pull request and explaining the fix.

02

OWASP Top 10

Knowing the common web weaknesses and how code prevents them.

03

SAST

Running static analysis and triaging what it reports.

04

DAST

Scanning a running app with OWASP ZAP in a test environment.

05

Dependency scanning

Finding outdated or risky packages and upgrading safely.

06

CI/CD security

Adding security gates to GitHub Actions.

07

Secrets handling

Keeping keys and passwords out of code and logs.

08

Clear write-ups

Explaining risk and fix so a developer agrees and acts.

Curriculum

The 12-week application security internship plan

Four phases. Each one ends in a deliverable that is reviewed and graded before the next opens.

Foundations

How web apps fail.

  • How web applications handle requests and data
  • OWASP Top 10 in plain language
  • Secure coding basics
  • Git and pull request workflow
Deliverable

A secure code review checklist applied to a sample pull request.

The capstone

Every intern leaves a pipeline that blocks insecure code

You take a real codebase, review it, fix what matters and add automated checks so the same problems are caught on every future pull request.

  • A secure code review with triaged findings
  • Automated SAST, dependency and DAST checks in CI
  • A short security guide the team can follow
Start your application
Ezitech seminar session with students at a university auditorium
Ezitech stall at a university open house and job fair
Ezitech receiving a shield at a university project presentation
Ezitech team and interns group photo outside the institute
Ezitech speaker presenting at a talent award ceremony
Ezitech mentors reviewing intern project documents
Ezitech team discussing an intern project brief in the office
01 / 07
Duration12 weeks
Commitment25 hrs / week
FormatOnsite + remote
LocationRawalpindi, PK
LevelJunior / fresher
ReviewsWeekly, 1-to-1
The Ezitech model

What the application security internship includes

Three things that make this different from a course you watch on a screen.

Live client briefs

You work on real Ezitech projects with real deadlines and real revision rounds, not recycled practice exercises.

A mentor, not a playlist

Weekly reviews with someone who does this work for a living, plus a team of interns around you to build with.

Portfolio and experience letter

You finish with shipped work you are allowed to show and a letter that says exactly what you delivered.

And you leave with

  • Verified certificate

    Issued by Ezitech Institute and verifiable by employers.

  • Experience letter

    On company letterhead, stating exactly what you delivered.

  • A secured pipeline

    CI security checks on a real codebase, with the fixes you made.

  • Interview preparation

    CV rewrite, portfolio case study and a technical mock interview.

  • A route into the team

    Top performers are considered first for paid junior roles.

  • Confidence in review

    Twelve weeks of defending your own work to a senior practitioner.

Built for you if

  • You are an undergraduate or fresh graduate in CS, SE, IT or cyber security
  • You already write code in at least one language
  • You want to make software safer, not just break it
  • You need a substantial final-year project

Not a fit if

  • You want a certificate without doing the work
  • You cannot give 25 hours a week for 12 weeks
  • You do not want to read or write code
  • You want to skip review and work alone
FAQ

Application security internship: questions people ask

Everything applicants email us about, answered before you apply.

Still not sure?

Talk to the admissions team before you commit twelve weeks.

Contact Ezitech

What is the difference between application security and penetration testing?
Penetration testing checks a finished system from the outside. Application security works inside the development process: code review, dependency checks and automated tests in the pipeline, so problems are caught before release.

Do I need to know how to code?
Yes. You should be comfortable in at least one language, such as JavaScript, Python, PHP or Java. Secure coding is taught from week one.

Is it remote or onsite?
Hybrid. Onsite days run at the Ezitech office in Rawalpindi for reviews and labs; the rest of the week is remote. Candidates outside Rawalpindi and Islamabad can complete it fully remotely if they attend the weekly review calls.

Is there a fee?
Yes, a one-time fee of PKR 5,000 for three months. There is no stipend. The refund rules are on the internship fee and refund policy page.

Can final-year students apply?
Yes. The capstone can be scoped as a final-year project. Agree the scope with your mentor in week one if your university has a set submission format.

How do I apply?
Register on the Ezitech intern portal, choose the Cyber Security track, and complete the three-step form with your education details and CV. Shortlisted candidates get a short screening call before the intake starts.
Other tracks

Not sure Application Security is the one?

Every cyber security internship runs three months, hybrid, with the same mentor model. Or take the six-month All-in-One Cyber Security flagship. Still choosing a field? Read which cyber security roles hire in Pakistan, or browse cyber security FYP ideas.

Ethical hacking

Penetration Testing

Test authorised lab targets and write findings developers can fix.

View track
Cloud

Cloud Security

Lock down cloud accounts, permissions and logging.

View track
Blue team

SOC Analyst

Triage alerts in a SIEM and write reports a team acts on.

View track
Governance

GRC

Map controls to ISO 27001 and run a risk assessment.

View track
Applications open

Learn to stop insecure code before it ships

Three months, one shipped piece of real work, a mentor who reviews you every week. Registration takes five minutes.

Apply for this internship Talk to us first
Ezitech Institute · Rawalpindi, Pakistan · info@ezitech.org · +92 345 5555396
Chat on WhatsApp