Posted today · be early
Security Engineer Internship
Metasys
WorldwideremotePosted 1 day ago
Skill Required
Security-EngineerApplication-Security-EngineerCloud-Security-EngineerDevSecOps-EngineerSecurity-Compliance-EngineerSecurity-Engineer-InternSecurity-InternSecurity-InternshipsIT-Security-InternshipIT-Security-InternInformation-Security-InternshipNetwork-Security-InternshipInternship-CybersecurityInternship-Information-SecurityDevSecOps-Engineer-InternSecurity EngineersecuritySOCVaultPostgreSQLObservabilityCryptographyLangChainTerraformNext.jsNode.jsTestNGDockerDevOpsExpressReactCI/CDOAuthCloudRustOWASPIAMJWTandGenerative AICIInternship
Key highlights
- Stipend: Unpaid initially
- Duration: 3 months
- Location: Remote
- Key Requirement: PCI-DSS and GDPR compliance experience
- Potential for FTE/Paid conversion
Role overview
The Security Engineer is a critical role responsible for implementing and enforcing robust security practices across our entire integrated supply chain e-commerce platform. You will safeguard e-commerce transactions, secure internal tool integrations, and establish the trust framework for our AI agent operations, ensuring compliance with global regulatory standards like PCI-DSS and GDPR.
Responsibilities
- Secure all layers of the application, from the Next.js frontend to the NestJS modular monolith and the cloud infrastructure.
- Perform vulnerability assessments, code reviews, and threat modeling for all new features and systems, focusing on the critical MES $\rightarrow$ WMS $\rightarrow$ OMS business process flow.
- Lead the implementation and auditing of security controls necessary for PCI-DSS compliance (for Payment module) and GDPR compliance (for user/tenant data handling).
- Implement and manage secure API authentication methods, including OAuth 2.0 and SAML, utilizing Authentik/Ory Kratos and leveraging PostgreSQL's Row-Level Security (RLS) for tenant isolation.
- Manage secrets and key rotation using Vault, define and enforce encryption protocols for data both in transit and at rest, and manage certificates via Traefik.
- Implement and monitor controls for API rate limiting, Web Application Firewall (WAF) rules, and traffic monitoring to prevent abuse and denial-of-service attacks.
- Develop and practice incident investigation and response protocols.
- Conduct security awareness training for development and operations teams.
- Establish security boundaries for the AI agent interfaces, ensuring agents (built with LangChain/AutoGen) operate within strict permissions when accessing supply chain data (WMS, OMS).
- Implement validation and sanitization techniques to mitigate prompt injection and data exfiltration risks in user-facing LLM interactions.
Requirements
- Hands-on security experience with Node.js/NestJS security best practices, Next.js/React security, and PostgreSQL RLS.
- Experience with PCI-DSS and GDPR controls and auditing.
- Experience with OAuth 2.0, SAML, JWT, and Authentik/Ory Kratos.
- Experience with HashiCorp Vault, Docker, and Terraform.
- Experience with tools for Static/Dynamic Application Security Testing (SAST/DAST).
Benefits
- May convert to a paid internship, full-time role, or even direct client absorption (FTE) based on your performance
Additional details
- Duration: 3 months (extendable based on performance and project scope)
- Start Date: Immediate
- Location: Remote
- Stipend: Unpaid initially
- Performance will be measured by Security Scorecard (Reduction in identified vulnerabilities from assessments and code reviews), Compliance Audits (Successful passing of regular PCI-DSS and GDPR audits), and Incident Handling (Speed and effectiveness of security incident investigation and remediation).
- Mentorship Structure: Reports to the Solution Architect or Head of Technology, working closely with the development and DevOps teams to embed security into the CI/CD pipeline.
- Originally posted on Himalayas