Graduate Intern - Software Security

We are looking for a graduate-level intern to join our engineering team and help strengthen the security of our PC-based industrial control software. You'll help prepare our products for the EU Cyber Resilience Act (CRA), which requires manufacturers of products with digital elements to build security in from the start, manage vulnerabilities for the full product lifecycle, and keep evidence that they comply.

You'll use industry-standard and AI-assisted security tools for updates of ongoing, automated assessments of our software, find and rank risks, and contribute to documentation needed for compliance. You'll work directly with software engineers and gain hands-on experience in product security in an industrial setting.

Security assessment and testing

• Run Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) on application code and interfaces
• Do Software Composition Analysis (SCA) to find vulnerable or outdated third-party and open-source components
• Help with fuzz testing, configuration reviews, and checks for common weakness types (for example, the CWE Top 25 and OWASP Top 10)
• Triage findings, remove false positives, and score severity with the Common Vulnerability Scoring System (CVSS)

Threat modeling and risk analysis

• Build and maintain threat models with established methods such as STRIDE, including data flow diagrams and trust boundaries
• Help write the cybersecurity risk assessment the CRA requires, and map each threat to a mitigation and its residual risk
• Assess attack surface, including network services, update mechanisms, licensing and authentication functions, and connections to the industrial equipment

Cyber Resilience Act Compliance Support

• Perform a gap analysis against the CRA's essential cybersecurity requirements (Annex I) and help prepare technical documentation for the conformity assessment
• Help define the Coordinated Vulnerability Disclosure (CVD) policy and vulnerability handling process, including the CRA reporting duties for actively exploited vulnerabilities
• Map controls to related frameworks: IEC 62443-4-1/4-2 (industrial automation security), NIST Secure Software Development Framework (SSDF, SP 800-218), and OWASP SAMM

Secure development lifecycle (SDL) and automation

• Add security scanning to the Continuous Integration/Continuous Delivery (CI/CD) pipeline (DevSecOps)
• Use AI-assisted tools to speed up code review, vulnerability triage, threat model drafting, and documentation, and check all AI output for accuracy
• Help assess secure update, code signing, secure default configuration, and secrets management practices
• Write clear findings reports and remediation guidance for engineering teams

• Currently enrolled in a master's or PhD program in Cybersecurity, Computer Science, Computer Engineering, or related field
• Solid grasp of secure coding principles and common vulnerability types
• Familiarity with the Windows operating system and basic networking
• Strong analytical and written communication skills, and the ability to explain technical risk in plain language

• Coursework or experience in application security, penetration testing, or threat modeling
• Familiarity with the EU Cyber Resilience Act, IEC 62443, NIST SSDF, or similar regulations and standards
• Experience with industrial control systems (ICS) or operational technology (OT) security
• Hands-on use of AI tools in security or software engineering work
• Capture the Flag (CTF) participation, published research, or security certifications (for example, CompTIA Security+, GIAC, or OSCP)

• Real experience delivering regulatory compliance work on a commercial industrial product
• Mentorship from senior engineers and exposure to the full secure development lifecycle
• A portfolio of practical deliverables, such as threat models, SBOMs, and assessment reports
• Possible opportunity to turn the internship into a thesis or capstone project, subject to confidentiality agreements

Location: Kent, Washington

Skills:

At Hypertherm Associates, we are committed to building an inclusive diverse, flexible, and collaborative environment. If our mission resonates with you, but you don’t meet all posted requirements, we encourage you to still apply.  We will evaluate your application materials and may suggest alternative roles that better leverage your strengths and talents.  For positions with multiple levels, we will evaluate your prior experience to determine the level within our organization you are best aligned based upon the job applying.