Information Security Intern

Incident response is a big part of the work: ransomware recovery, business email compromise and forensic investigations. Based in New York City, Carter Threat Labs also trains client staff and runs simulated phishing campaigns.

About the role:

Our Governance and Compliance team runs vulnerability scans, reviews cloud settings and handles phishing reports. The intern helps with all of it. Remote position. Most of the team is in New York City, but nobody is required to come in. You can set your own hours around a daily morning check-in. You get a company laptop and a headset before you start.

Day to day:

• Prepare short security awareness posts and quizzes for staff.
• Track open vulnerabilities in Jira and follow up with owners on fixes.
• Triage phishing emails reported by staff and update block lists.
• Help review access lists and remove accounts that are no longer needed.
• Update security policies and runbooks in Confluence.

What we're looking for:

• Available 40 hours a week for the full internship.
• Based in the US for the duration of the internship.
• Authorized to work in the US. CPT and OPT candidates are welcome to apply.
• Pursuing a degree in Computer Science, IT, Cyber Security or a related field, graduating in 2028.
• Hands-on practice through TryHackMe, Hack The Box or college labs.
• Basic knowledge of common web attacks such as XSS, SQL injection and CSRF.
• Strong sense of ethics. You will see sensitive data and must stay strictly within scope.
• Some scripting in Python or Bash.

Bonus points:

• Experience with Wireshark, Nmap or Burp Suite.

Duration: 3 months

Start date: Mar 2027

Stipend: $43.50 - $49.50 an hour

What we offer:

• Learning and development stipend.
• Intern events and speaker sessions (virtual)
• Paid sick time.
• Home office setup stipend.

Duration: 3 months. Start: Mar 2027.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Carter Threat Labs.