Summer 2027 Internship - Information Security Engineer

General Matter•Los Angeles, CA

8d•Onsite

About The Position

General Matter is hiring an Information Security Engineer intern for Summer 2027. The company builds software, firmware, control systems, and infrastructure for an industrial nuclear fuel facility. The Security team identifies vulnerabilities through offensive testing, code audits, design reviews, and system hardening. The intern will attack General Matter products and infrastructure and work with the engineers responsible for them to address findings. Targets may include web applications, APIs, Linux and Windows hosts, cloud environments, embedded devices, and industrial controllers. Interns own projects from start to finish and focus on hands-on security work rather than policy writing. The internship is full-time and on-site in Los Angeles, California, for the entire internship, at 40 hours per week. The position may require extended hours, and interns are eligible for overtime pay. The hourly pay range is $32–$46, depending on the candidate’s current standing in school. Interns also receive a monthly housing stipend. All security testing must be conducted on General Matter-owned systems within an approved scope and rules of engagement.

Requirements

Currently pursuing a bachelor's, master's, or PhD in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, or a related field.
Security experience in one or more of the following: C, C++, Rust, Go, Python, x86, ARM, cryptography, reverse engineering, embedded systems, or network protocols.
Strong understanding of common vulnerability classes and how to exploit them, including SQL injection, XSS, CSRF, SSRF, memory corruption, and authentication or authorization flaws.
Experience auditing code and features, and comfort reading large codebases that the candidate did not write.
Strong investigative and analytical problem-solving skills, including persistence after obvious attacks fail.
Clear written communication skills so system owners can understand and fix security findings.
Willing and able to work on-site in Los Angeles, California, full-time (40 hours per week), for the entire internship.
Conduct all testing on General Matter-owned systems within an approved scope and rules of engagement.

Nice To Haves

Hands-on offensive security experience, such as CTF competitions, bug bounties, CVEs, security research, or homelab projects.
Experience with fuzzing tools such as AFL++ or libFuzzer, static analysis tools such as Semgrep or CodeQL, and sandboxing or exploit mitigations.
Experience with tools such as Burp Suite, Ghidra, IDA, Binary Ninja, Wireshark, or Metasploit.
Hardware hacking experience, such as firmware dumps, UART/JTAG/SWD, logic analyzers, or basic fault injection.
Experience with industrial control systems, PLCs, SCADA, or OT protocols; this is a plus but not required, and training will be provided.
Experience attacking Windows/Active Directory, Linux, cloud environments (AWS, Azure, or GCP), containers, or Kubernetes.
A GitHub profile, blog, CTF writeup, CVE, or bug bounty profile demonstrating security work.

Responsibilities

Run penetration tests against company networks, services, web applications, and APIs.
Demonstrate vulnerabilities with working proof-of-concept exploits.
Audit source code and features for security vulnerabilities in languages such as Python, C, C++, Rust, Go, and TypeScript.
Build static analysis rules or CI checks to prevent recurring classes of vulnerabilities.
Reverse engineer and attack embedded devices and industrial equipment on an isolated test bench, including firmware extraction, binary analysis on x86 and ARM, debugging interfaces, and PLC and industrial protocol implementations.
Conduct threat modeling and adversarial design reviews with software, controls, and hardware engineers, and help design secure system architectures.
Assess third-party software, devices, and services and work with vendors and suppliers to resolve identified issues.
Test cloud and identity infrastructure for issues such as IAM misconfigurations, exposed secrets, privilege escalation paths, and CI/CD supply chain weaknesses.
Build automated tooling to identify known security exposures and continue operating after the internship ends.
Present findings and fixes to the engineers and leaders responsible for the systems.