Hire Penetration Testing Intern from India’s verified campus pool

Insist on knowing what to do when something interesting sits outside the agreed scope, and on enough writing a defect report a developer can reproduce without asking questions to work unsupervised on small tasks. Legal and ethical boundaries is the third thing worth testing in the interview. Tool familiarity — Burp Suite, Nmap, Metasploit — is a bonus rather than a filter: most of it is a week of learning for someone with the underlying skill.

One finished thing. Complete one scoped, authorised test and deliver a report a developer can act on is the right size: real work someone on the team would otherwise do, small enough to finish, visible enough to assess. If they move quickly, turn the ten most repeated bugs into automated regression checks is the natural second piece. A term with three half-finished projects assesses nothing and teaches less.

Start from ₹16,000–₹40,000 a month, then adjust for city and duration: metros at the top, tier-2 typically 25–40% lower, and six-month commitments above six-week ones. Publish the number in the listing — "as per industry standards" is read as low or undecided, and it costs you applications from exactly the candidates who had another option.

For a first pass, yes. Ask "What do you do if you find something outside the agreed scope?" and judge whether the answer is specific and consistent — you are checking for ethics and discipline — the single most important answer here, which does not require you to know the subject. A Ethical Hacking practitioner should still take the second round, because at that point you are assessing depth rather than authenticity.

One finished, reviewed piece of work that someone on the team would otherwise have done — not a side project nobody adopts. The deliverables above are sized for eight to twelve weeks of supervised work by a student with the fundamentals but no production experience. If they can demo it and the team keeps using it after they leave, the hire paid for itself.

A testing brief here needs written authorisation and a defined scope. Both must exist before the intern starts, and the scope conversation is itself part of their training. In screening terms, that means adding one specific check: knowing what to do when something interesting sits outside the agreed scope.

A testing brief only pays off when someone acts on what is found. Before posting, decide who triages the defects — a tester whose findings sit untouched stops finding things by week four. In screening terms, that means adding one specific check: writing a defect report a developer can reproduce without asking questions.

No. The posting assistant asks a few short questions — the role, the work, the duration, the stipend — and drafts the description, the title and the skill tags for you. You review and edit everything before it publishes, and you can paste in your own description if you already have one.

Specificity does most of the work. A listing that names the project, the tools and the deliverable filters itself, because candidates can tell whether they fit. Adding one screening question to the application — from the set above — removes most of the rest without adding a review round.