Product Security Intern

Buildertrend Solutions•Omaha, NE

8d•Onsite

About The Position

As a Product Security Intern, you'll spend the summer helping protect a platform construction professionals rely on every day. You'll work alongside experienced security engineers, learn how security gets built into the software development lifecycle, and get hands-on with the same tools and workflows our Product Security team uses to keep Buildertrend's customers safe. By the end of the internship, you'll have sharpened your security skills, gained real-world experience with application and cloud security, and contributed to work that protects the way the world builds.

Requirements

Currently pursuing a bachelor’s or master’s degree in computer science, cybersecurity, information security, mathematics, physics, engineering or a related field.
Available to work full-time onsite at the Buildertrend HQ in Omaha, NE, for the full summer.
Strong interest in product security and a desire to grow your skills.
Experience using AI tools (such as Claude, GitHub Copilot or similar) in coursework or personal projects, or a strong interest in learning how to use them effectively.
Foundational understanding of web application security concepts (OWASP Top 10) and at least one programming or scripting language (e.g., Python, C#, JavaScript, Bash).
Basic understanding of authentication and authorization concepts (OAuth, SAML, JWTs, session management), plus exposure to or interest in cloud platforms (GCP) and their security models.
Familiarity with Linux/Unix command-line environments and networking fundamentals (TCP/IP, DNS, HTTP).
Interest in learning security tools and techniques, including vulnerability scanners, proxy tools (e.g., Burp Suite) and CI/CD security integrations.
Strong analytical and problem-solving skills, clear written and verbal communication, and comfortable working both independently and as part of a team.
Eager to learn, ask questions and apply feedback constructively.

Nice To Haves

Participation in CTF competitions, security-related clubs, or relevant coursework (computer networking, application security, operating systems or cryptography) is a plus, any level helps.

Responsibilities

Assist in running and triaging results from SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) scanning tools under the guidance of senior security engineers.
Help investigate and validate security findings, distinguishing true positives from false positives and documenting confirmed vulnerabilities.
Support the review of authentication and authorization implementations, including OAuth 2.0 flows, token handling and role-based access controls.
Assist with cloud security posture reviews in GCP and Azure, including IAM policy analysis, storage access controls and network configuration checks.
Contribute to maintaining and improving security scanning pipelines integrated into CI/CD workflows.
Participate in secure code reviews alongside security engineers, learning to identify common vulnerability patterns (injection, XSS, insecure deserialization, broken access control).
Help maintain and update internal security documentation, runbooks and vulnerability tracking records.
Support dependency and software composition analysis (SCA) scanning to identify known vulnerabilities in third-party libraries.
Assist in basic penetration testing activities and security assessments as directed.
Participate in team meetings, incident reviews and security-focused sprint activities.
Work on an assigned security project with regular check-ins and progress updates to mentors.
Use AI-assisted development tools, including Claude, to accelerate security analysis, research and problem-solving while still being responsible and accountable for the quality and accuracy of your work.