Year-Round Intern, Application Security

About The Team & Role

The Product & Application Security team is responsible for securing OCC's applications across their entire lifecycle, from code to production. This involves security testing (penetration testing, SAST, DAST, SCA, container scanning), integrating security into developer workflows and CI/CD pipelines, and vulnerability research and advisory. The core mission is to make secure development the path of least resistance for every developer at OCC.

The intern will support a key initiative: using frontier AI models to develop, codify, and embed security standards directly into OCC's developer workflows and AI-assisted coding environments. This includes building AI-consumable security configurations, automating the enforcement of security standards within existing tooling and pipelines, and helping reduce the manual effort required to maintain consistency across OCC's development ecosystem. This role offers hands-on experience at the intersection of application security, software engineering, and frontier AI.

Job Summary & Responsibilities

The intern will work within the Product & Application Security (AppSec) team on a high-impact initiative: using frontier AI models to research, build, and embed security standards directly into how OCC's developers write code. This role involves using AI as a core engineering tool to codify security requirements, automate their enforcement, and embed them into developer workflows and AI-assisted coding environments.

• Using frontier AI models and LLMs as core engineering tools to research, synthesize, and codify OCC-specific secure coding standards based on industry frameworks (OWASP, NIST, CIS).
• Building AI-consumable configuration files (e.g., Claude.md) that embed security requirements directly into AI-assisted developer workflows and GitHub repositories across OCC.
• Automating the enforcement of security standards within CI/CD pipelines and developer tooling (Snyk, SAST/DAST tools, GitHub), writing automation that runs in production workflows.
• Collaborating with development teams to integrate and test security standards in real developer environments.
• Assisting with vulnerability triage and remediation guidance, gaining exposure to real-world security findings alongside experienced AppSec engineers.

Requirements & Tech Stack

Candidate Qualifications

• Rising senior or second-year graduate student, graduating December 2027 or May/August 2028.

Desired Majors

• Computer Science
• Cybersecurity / Information Security
• Software Engineering
• Computer Engineering
• Management Information Systems

Technical Skills/Experience Desired

• Basic programming/scripting ability (Python, Bash, or similar) for automation work.
• Familiarity with software development concepts and the SDLC.
• Understanding of version control (Git/GitHub).
• Basic familiarity with AI/LLM tools and concepts (Claude, GitHub Copilot, Cursor, or similar).
• Exposure to CI/CD concepts (GitHub Actions, Jenkins, etc.) a plus.
• Familiarity with security concepts — OWASP Top 10, common vulnerability classes a plus.
• Experience with any security tooling (Snyk, SonarQube, Burp Suite, etc.) a plus.
• Familiarity with static analysis or code review a plus.
• Basic understanding of APIs and how applications communicate a plus.
• Exposure to cloud environments (AWS, Azure, GCP) a plus.
• Experience with prompt engineering or structuring AI-consumable instruction files (e.g., markdown-based configuration such as Claude.md) a plus.

Additional Qualifications

• Ability to work collaboratively across technical teams and communicate findings clearly to both security and non-security audiences.
• Self-starter who can take ownership of deliverables and drive work forward with minimal supervision.
• Strong written communication skills.
• Curiosity and willingness to learn; adaptability is important.
• Attention to detail.

Internship Details

• Internship type: Year-round intern
• Duration: 1,000 hours maximum, January 2027–December 2027
• Work hours: Up to 20 hours per week during the school year and up to 40 hours per week during the summer.
• Work environment: Hybrid Work Program. Requires working from an OCC office at least 3 days per week, with Tuesday and Wednesday as anchor days.
• Overtime: Not permitted.

Compensation

• Hourly rate: $25.00 - $25.00
• Eligible for an annual discretionary incentive compensation award based on performance.
• Paid sick leave accrued based on hours worked.