Graduate Software Security Intern - Hypertherm Associates
We are looking for a graduate-level intern to join our engineering team and help strengthen the security of our PC-based industrial control software. You'll help prepare our products for the EU Cyber Resilience Act (CRA) , which requires manufacturers of products with digital elements to build security in from the start, manage vulnerabilities for the full product lifecycle, and keep evidence that they comply.
You'll use industry-standard and AI-assisted security tools for updates of ongoing, automated assessments of our software, find and rank risks, and contribute to documentation needed for compliance. You'll work directly with software engineers and gain hands-on experience in product security in an industrial setting.
Key Responsibilities
Security assessment and testing
Run Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) on application code and interfaces
Do Software Composition Analysis (SCA) to find vulnerable or outdated third-party and open-source components
Help with fuzz testing, configuration reviews, and checks for common weakness types (for example, the CWE Top 25 and OWASP Top 10)
Triage findings, remove false positives, and score severity with the Common Vulnerability Scoring System (CVSS)
Threat modeling and risk analysis
Build and maintain threat models with established methods such as STRIDE , including data flow diagrams and trust boundaries
Help write the cybersecurity risk assessment the CRA requires, and map each threat to a mitigation and its residual risk
Assess attack surface, including network services, update mechanisms, licensing and authentication functions, and connections to the industrial equipment
Cyber Resilience Act Compliance Support
Perform a gap analysis against the CRA's essential cybersecurity requirements (Annex I) and help prepare technical documentation for the conformity assessment
Help define the Coordinated Vulnerability Disclosure (CVD) policy and vulnerability handling process, including the CRA reporting duties for actively exploited vulnerabilities
Map controls to related frameworks: IEC 62443-4-1/4-2 (industrial automation security) , NIST Secure Software Development Framework (SSDF, SP 800-218), and OWASP SAMM
Secure development lifecycle (SDL) and automation
Add security scanning to the Continuous Integration/Continuous Delivery (CI/CD) pipeline (DevSecOps)
Use AI-assisted tools to speed up code review, vulnerability triage, threat model drafting, and documentation, and check all AI output for accuracy
Help assess secure update, code signing, secure default configuration, and secrets management practices
Write clear findings reports and remediation guidance for engineering teams
Required qualifications
Currently enrolled in a master's or PhD program in Cybersecurity, Computer Science, Computer Engineering, or related field
Solid grasp of secure coding principles and common vulnerability types
Familiarity with the Windows operating system and basic networking
Strong analytical and written communication skills, and the ability to explain technical risk in plain language
Preferred qualifications
Coursework or experience in application security, penetration testing, or threat modeling
Familiarity with the EU Cyber Resilience Act, IEC 62443, NIST SSDF, or similar regulations and standards
Experience with industrial control systems (ICS) or operational technology (OT) security
Hands-on use of AI tools in security or software engineering work
Capture the Flag (CTF) participation, published research, or security certifications (for example, CompTIA Security+, GIAC, or OSCP)
What you'll gain
Real experience delivering regulatory compliance work on a commercial industrial product
Mentorship from senior engineers and exposure to the full secure development lifecycle
A portfolio of practical deliverables, such as threat models, SBOMs, and assessment reports
Possible opportunity to turn…