Summer 2027 Internship - Information Security Engineer

General Matter•Los Angeles, CA

8h•$32 - $46•Onsite

About The Position

General Matter is hiring a Summer 2027 Information Security Engineer intern to help secure the software, firmware, control systems, and infrastructure used at its industrial nuclear fuel facility. The intern will conduct offensive security testing, code audits, design reviews, and security hardening, working with the engineers responsible for the systems to address vulnerabilities. Targets include web applications, APIs, Linux and Windows hosts, cloud environments, embedded devices, and industrial controllers. Interns own projects from start to finish.

Requirements

Currently pursuing a Bachelor's, Master's, or PhD in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, or a related field.
Security experience in one or more of the following: C, C++, Rust, Go, Python, x86, ARM, cryptography, reverse engineering, embedded systems, or network protocols.
Strong understanding of common vulnerability classes and how to exploit them, including SQL injection, XSS, CSRF, SSRF, memory corruption, and authentication or authorization flaws.
Experience auditing code and features, and comfort reading large codebases written by others.
Strong investigative and analytical problem-solving skills, including persistence when obvious attacks fail.
Clear written communication skills.
Willing and able to work on-site in Los Angeles, California, full-time (40 hours per week) for the entire internship.
Perform all testing on General Matter-owned systems and within an approved scope and rules of engagement.

Nice To Haves

Hands-on offensive security experience, such as CTF competitions, bug bounties, CVEs, security research, or homelab projects.
Experience with fuzzing tools such as AFL++ or libFuzzer, static analysis tools such as Semgrep or CodeQL, and sandboxing or exploit mitigations.
Experience with tools such as Burp Suite, Ghidra, IDA, Binary Ninja, Wireshark, or Metasploit.
Hardware hacking experience, such as firmware dumps, UART/JTAG/SWD, logic analyzers, or basic fault injection.
Experience with industrial control systems, PLCs, SCADA, or OT protocols.
Experience attacking Windows/Active Directory, Linux, cloud environments (AWS, Azure, or GCP), containers, or Kubernetes.
A GitHub profile, blog, CTF writeup, CVE, or bug bounty profile demonstrating security work.

Responsibilities

Penetration test General Matter networks, services, web applications, and APIs, and demonstrate findings with working proof-of-concept exploits.
Audit source code and features for vulnerabilities in languages including Python, C, C++, Rust, Go, and TypeScript; develop static analysis rules or CI checks to prevent recurrence.
Reverse engineer and attack embedded devices and industrial equipment on an isolated test bench, including firmware extraction, binary analysis on x86 and ARM, debugging interfaces, and PLC and industrial protocol implementations.
Conduct threat modeling and adversarial design reviews with software, controls, and hardware engineers, and help design secure architectures.
Assess third-party software, devices, and services, and work with vendors and suppliers to resolve identified issues.
Test cloud and identity infrastructure for issues such as IAM misconfigurations, exposed secrets, privilege escalation paths, and CI/CD supply chain weaknesses.
Build automated tooling to identify known security exposures and continue operating after the internship.
Present security findings and fixes to the engineers and leaders responsible for the systems.