Graduate Intern - Software Security

Location: Kent, WA

Graduate Software Security Intern - Hypertherm Associates

We are looking for a graduate-level intern to join our engineering team and help strengthen the security of our PC-based industrial control software. You'll help prepare our products for the EU Cyber Resilience Act (CRA), which requires manufacturers of products with digital elements to build security in from the start, manage vulnerabilities for the full product lifecycle, and keep evidence that they comply.

You'll use industry-standard and AI-assisted security tools for updates of ongoing, automated assessments of our software, find and rank risks, and contribute to documentation needed for compliance. You'll work directly with software engineers and gain hands-on experience in product security in an industrial setting.

Key Responsibilities

Security assessment and testing

Run Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) on application code and interfaces

Do Software Composition Analysis (SCA) to find vulnerable or outdated third-party and open-source components

Help with fuzz testing, configuration reviews, and checks for common weakness types (for example, the CWE Top 25 and OWASP Top 10)

Triage findings, remove false positives, and score severity with the Common Vulnerability Scoring System (CVSS)

Threat modeling and risk analysis

Build and maintain threat models with established methods such as STRIDE, including data flow diagrams and trust boundaries

Help write the cybersecurity risk assessment the CRA requires, and map each threat to a mitigation and its residual risk

Assess attack surface, including network services, update mechanisms, licensing and authentication functions, and connections to the industrial equipment

Cyber Resilience Act Compliance Support

Perform a gap analysis against the CRA's essential cybersecurity requirements (Annex I) and help prepare technical documentation for the conformity assessment

Help define the Coordinated Vulnerability Disclosure (CVD) policy and vulnerability handling process, including the CRA reporting duties for actively exploited vulnerabilities

Map controls to related frameworks: IEC 62443-4-1/4-2 (industrial automation security), NIST Secure Software Development Framework (SSDF, SP 800-218), and OWASP SAMM

Secure development lifecycle (SDL) and automation

Add security scanning to the Continuous Integration/Continuous Delivery (CI/CD) pipeline (DevSecOps)

Use AI-assisted tools to speed up code review, vulnerability triage, threat model drafting, and documentation, and check all AI output for accuracy

Help assess secure update, code signing, secure default configuration, and secrets management practices

Write clear findings reports and remediation guidance for engineering teams

Required qualifications

Currently enrolled in a master's or PhD program in Cybersecurity, Computer Science, Computer Engineering, or related field

Solid grasp of secure coding principles and common vulnerability types

Familiarity with the Windows operating system and basic networking

Strong analytical and written communication skills, and the ability to explain technical risk in plain language

Preferred qualifications

Coursework or experience in application security, penetration testing, or threat modeling

Familiarity with the EU Cyber Resilience Act, IEC 62443, NIST SSDF, or similar regulations and standards

Experience with industrial control systems (ICS) or operational technology (OT) security

Hands-on use of AI tools in security or software engineering work

Capture the Flag (CTF) participation, published research, or security certifications (for example, CompTIA Security+, GIAC, or OSCP)

What you'll gain

Real experience delivering regulatory compliance work on a commercial industrial product

Mentorship from senior engineers and exposure to the full secure development lifecycle

A portfolio of practical deliverables, such as threat models, SBOMs, and assessment reports

Possible opportunity to turn the internship into a thesis or capstone project, subject to confidentiality agreements

Location: Kent, Washington

Sponsorship of new applicants for employment authorization, or any other immigration-related support, is not available for this position at this time.

Skills

Hypertherm Associates is proud to be an Equal Opportunity Employer, and we welcome all applications. We recruit, employ, train, compensate, and promote without regard to race, color, religion, sex, age, national origin, disability, or veteran status, or any other characteristic protected by federal, state, or local laws.

At Hypertherm Associates, we are committed to building an inclusive diverse, flexible, and collaborative environment. If our mission resonates with you, but you don’t meet all posted requirements, we encourage you to still apply.  We will evaluate your application materials and may suggest alternative roles that better leverage your strengths and talents.  For positions with multiple levels, we will evaluate your prior experience to determine the level within our organization you are best aligned based upon the job applying.

CURRENT ASSOCIATES OR TEMPORARY ASSOCIATES: Please apply via your internal Workday career account.

$0.00-$0.00 HourlyThis is the base pay range that an applicant can expect to make upon hire. Pay within this range will vary based upon relevant experience, skills, and education among other factors.