Help write the cybersecurity risk assessment the CRA requires, and map each threat to a mitigation and its residual risk
Assess attack surface, including network services, update mechanisms, licensing and authentication functions, and connections to the industrial equipment
Cyber Resilience Act Compliance Support
Perform a gap analysis against the CRA's essential cybersecurity requirements (Annex I) and help prepare technical documentation for the conformity assessment
Help define the Coordinated Vulnerability Disclosure (CVD) policy and vulnerability handling process, including the CRA reporting duties for actively exploited vulnerabilities
Map controls to related frameworks: IEC 62443-4-1/4-2 (industrial automation security), NIST Secure Software Development Framework (SSDF, SP 800-218), and OWASP SAMM
Secure development lifecycle (SDL) and automation
Add security scanning to the Continuous Integration/Continuous Delivery (CI/CD) pipeline (DevSecOps)
Use AI-assisted tools to speed up code review, vulnerability triage, threat model drafting, and documentation, and check all AI output for accuracy
Help assess secure update, code signing, secure default configuration, and secrets management practices
Write clear findings reports and remediation guidance for engineering teams
Required qualifications
Currently enrolled in a master's or PhD program in Cybersecurity, Computer Science, Computer Engineering, or related field
Solid grasp of secure coding principles and common vulnerability types
Familiarity with the Windows operating system and basic networking
Strong analytical and written communication skills, and the ability to explain technical risk in plain language
Preferred qualifications
Coursework or experience in application security, penetration testing, or threat modeling
Familiarity with the EU Cyber Resilience Act, IEC 62443, NIST SSDF, or similar regulations and standards
Experience with industrial control systems (ICS) or operational technology (OT) security
Hands-on use of AI tools in security or software engineering work
Capture the Flag (CTF) participation, published research, or security certifications (for example, CompTIA Security+, GIAC, or OSCP)
What you'll gain
Real experience delivering regulatory compliance work on a commercial industrial product
Mentorship from senior engineers and exposure to the full secure development lifecycle
A portfolio of practical deliverables, such as threat models, SBOMs, and assessment reports
Possible opportunity to turn the internship into a thesis or capstone project, subject to confidentiality agreements
Location: Kent, Washington
Sponsorship of new applicants for employment authorization, or any other immigration-related support, is not available for this position at this time.
Skills
Hypertherm Associates is proud to be an Equal Opportunity Employer, and we welcome all applications. We recruit, employ, train, compensate, and promote without regard to race, color, religion, sex, age, national origin, disability, or veteran status, or any other characteristic protected by federal, state, or local laws.
At Hypertherm Associates, we are committed to building an inclusive diverse, flexible, and collaborative environment. If our mission resonates with you, but you don’t meet all posted requirements, we encourage you to still apply. We will evaluate your application materials and may suggest alternative roles that better leverage your strengths and talents. For positions with multiple levels, we will evaluate your prior experience to determine the level within our organization you are best aligned based upon the job applying.
CURRENT ASSOCIATES OR TEMPORARY ASSOCIATES: Please apply via your internal Workday career account.
- $0.00-$0.00 Hourly
- This is the base pay range that an applicant can expect to make upon hire.
Pay within this range will vary based upon relevant experience, skills, and education among other factors.
