Cyber Security Internship

Find the holes in your own work before anyone else does.

Defensive security, done on systems you own or on deliberately vulnerable practice targets. You will learn to think about how software fails under someone actively trying to break it — and to write the finding up so an engineer can fix it.

Intermediate4 weeks · remote4 briefs · complete any 2Free to join

What you'll be able to do

Test a web application against the OWASP Top 10
Write a vulnerability report an engineer can act on
Harden a system and prove the hardening worked
Understand why most breaches are configuration, not exploits

Who it suits

Developers and students who want defensive security skills. All work is done on your own systems or on legal practice targets — never on anything you do not own.

What you'll work with

Python
Burp Suite Community
OWASP ZAP
Wireshark
Linux
Docker

The project briefs

Complete any 2 of these 4to finish the programme. Assessment criteria are published here so you know what “good” means before you start.

Audit a Deliberately Vulnerable Application

~12h estimated

Find and document real vulnerabilities on a legal practice target.

Use OWASP Juice Shop or DVWA — both exist precisely for this. Work the OWASP Top 10 methodically. For each finding, prove it, explain the impact, and write the fix.

Assessed against

Five or more distinct findings, each with reproduction steps
Severity rated with stated reasoning
A concrete remediation for every finding
Testing performed only on the practice target

Suggested datasets

OWASP Juice Shop
DVWA
PortSwigger Web Security Academy labs

You'll finish with

GitHub repo with the report
Reproduction steps per finding

Secure Code Review

~10h estimated

Read code the way an attacker would.

Take an open-source project or your own earlier work. Look for injection, weak authentication, secrets in the repo, and unsafe defaults. A static analysis tool is a starting point, not the review.

Assessed against

At least 300 lines reviewed line by line
Findings mapped to a recognised category (OWASP or CWE)
A patch for at least one real issue
Clear separation of what the tool found from what you found

You'll finish with

Review document
A pull request or patch file

Harden a Server and Prove It

~10h estimated

Lock down a system you own, then demonstrate the difference.

Spin up a VM or container. Scan it. Harden it — firewall, SSH keys only, least privilege, patched packages. Scan again. The delta is your result.

Assessed against

Before and after scan output
Every change justified, not just applied from a checklist
Firewall rules documented with reasoning
A note on what you chose not to harden, and why

You'll finish with

GitHub repo with configs
Before and after scan reports

Build a Security Tool

~10h estimated

Automate one piece of security work you did by hand.

A secrets scanner, a header checker, a log anomaly detector. Small and correct beats broad and noisy — a tool that cries wolf gets switched off.

Assessed against

Solves one clearly stated problem
A low false-positive rate, measured on real input
Machine-readable output so it can run in CI
Documentation covering what it does not catch

You'll finish with

GitHub repo
Sample output
Honest limitations section

Free to apply and free to complete. The completion certificate is optional.

Other domains

AI Agents & Automation

Build autonomous agents that use tools, not chatbots that answer questions.

Generative AI & LLMs

Go past prompt tinkering into retrieval, evaluation and cost control.

Machine Learning

Classical ML done properly — including the evaluation everyone skips.

Ready to Transform Your Enterprise with AI?

Book a free 30-minute consultation with our AI architects. Discover how agentic AI can automate your workflows and multiply your team's output.

No commitment required · Free architecture review · NDA protected

Cyber Security Internship

Find the holes in your own work before anyone else does.

Intermediate4 weeks · remote4 briefs · complete any 2Free to join

What you'll be able to do

Test a web application against the OWASP Top 10

Write a vulnerability report an engineer can act on

Harden a system and prove the hardening worked

Understand why most breaches are configuration, not exploits

Who it suits

Developers and students who want defensive security skills. All work is done on your own systems or on legal practice targets — never on anything you do not own.

The project briefs

Complete any 2 of these 4to finish the programme. Assessment criteria are published here so you know what “good” means before you start.

Audit a Deliberately Vulnerable Application

~12h estimated

Find and document real vulnerabilities on a legal practice target.

Use OWASP Juice Shop or DVWA — both exist precisely for this. Work the OWASP Top 10 methodically. For each finding, prove it, explain the impact, and write the fix.

Assessed against

Five or more distinct findings, each with reproduction steps
Severity rated with stated reasoning
A concrete remediation for every finding
Testing performed only on the practice target

Suggested datasets

OWASP Juice Shop
DVWA
PortSwigger Web Security Academy labs

You'll finish with

GitHub repo with the report
Reproduction steps per finding

Secure Code Review

~10h estimated

Read code the way an attacker would.

Take an open-source project or your own earlier work. Look for injection, weak authentication, secrets in the repo, and unsafe defaults. A static analysis tool is a starting point, not the review.

Assessed against

At least 300 lines reviewed line by line
Findings mapped to a recognised category (OWASP or CWE)
A patch for at least one real issue
Clear separation of what the tool found from what you found

You'll finish with

Review document
A pull request or patch file

Harden a Server and Prove It

~10h estimated

Lock down a system you own, then demonstrate the difference.

Spin up a VM or container. Scan it. Harden it — firewall, SSH keys only, least privilege, patched packages. Scan again. The delta is your result.

Assessed against

Before and after scan output
Every change justified, not just applied from a checklist
Firewall rules documented with reasoning
A note on what you chose not to harden, and why

You'll finish with

GitHub repo with configs
Before and after scan reports

Build a Security Tool

~10h estimated

Automate one piece of security work you did by hand.

A secrets scanner, a header checker, a log anomaly detector. Small and correct beats broad and noisy — a tool that cries wolf gets switched off.

Assessed against

Solves one clearly stated problem
A low false-positive rate, measured on real input
Machine-readable output so it can run in CI
Documentation covering what it does not catch

You'll finish with

GitHub repo
Sample output
Honest limitations section

Free to apply and free to complete. The completion certificate is optional.