Summer 2027 Internship - Information Security Engineer

General Matter builds its own technology: the software, firmware, control systems, and infrastructure that run an industrial nuclear fuel facility. At most companies, a security bug costs you data. Here, the software we build, and any security vulnerabilities we miss, touch the real world. The Security team's job is to find those gaps before anyone else does. We do that through offensive testing, code audits, design reviews, and hardening the systems we ship. 

As an intern on the team, you'll attack General Matter's products and infrastructure, while working with the engineers who own them to fix what you find. Targets include web apps, APIs, Linux and Windows hosts, cloud environments, embedded devices, and industrial controllers. You'll own real projects from start to finish, and you won't be writing policy documents

• →Break everything you touch, then help us fix it. 
• →Run penetration tests against General Matter networks, services, web applications, and APIs. Prove what you find with working proof-of-concept exploits. 
• →Audit source code and features for security vulnerabilities in languages like Python, C, C++, Rust, Go, and TypeScript. Then build static analysis rules or CI checks so the same class of bug can't come back. 
• →Reverse engineer and attack embedded devices and industrial equipment on an isolated test bench. That includes firmware extraction, binary analysis on x86 and ARM, debug interfaces (JTAG, SWD, UART), and PLC and industrial protocol implementations (Modbus, EtherNet/IP, OPC UA). 
• →Do threat modeling and adversarial design reviews with software, controls, and hardware engineers. Help design a secure architecture for systems before they ship. 
• →Assess third-party software, devices, and services before they get into our environment, and work with vendors and suppliers to get the issues fixed. 
• →Attack cloud and identity infrastructure, including IAM misconfigurations, exposed secrets, privilege escalation paths, and CI/CD supply chain weaknesses. 
• →Build automated tooling that spots known security exposures and keeps running after your internship ends. 
• →Present your findings and fixes to the engineers and leaders who own the systems. 

• Currently pursuing a Bachelor's, Master's, or PhD in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, or a related field 
• Security experience in one or more of the following: C, C++, Rust, Go, Python, x86, ARM, cryptography, reverse engineering, embedded systems, or network protocols. 
• A strong understanding of common vulnerability classes and how to exploit them, such as SQLi, XSS, CSRF, SSRF, memory corruption, and authentication or authorization flaws. 
• Experience auditing code and features, and comfort reading large codebases you didn't write. 
• Strong investigative and analytical problem-solving skills. You keep digging after the obvious attacks fail. 
• Clear written communication. A finding only counts if the engineer who owns the system understands it and can fix it. 

• Hands-on offensive security experience. CTF competitions are ideal, and bug bounties, CVEs, security research, or homelab projects also count. 
• Experience with fuzzing (AFL++, libFuzzer), static analysis (Semgrep, CodeQL), and sandboxing or exploit mitigations. 
• Experience with tools like Burp Suite, Ghidra, IDA, Binary Ninja, Wireshark, or Metasploit. 
• Hardware hacking experience, such as firmware dumps, UART/JTAG/SWD, logic analyzers, or fault injection basics. 
• Experience with industrial control systems, PLCs, SCADA, or OT protocols. This is a plus but not required, and we'll teach you. 
• Experience attacking Windows/Active Directory, Linux, cloud (AWS, Azure, GCP), containers, or Kubernetes. 
• A GitHub, blog, CTF writeup, CVE, or bug bounty profile that shows us something you've broken. 

• Willing and able to work on-site in Los Angeles, CA, full-time (40 hours/week), for the whole internship. 
• All testing is done on General Matter-owned systems, within an approved scope and rules of engagement. 
• This position may require extended hours, and interns are eligible for overtime pay. 

General Matter is an Equal Opportunity Employer; employment with General Matter is governed on the basis of merit, competence and qualifications and will not be influenced in any manner by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability or any other legally protected status.