Cybersecurity Winter/Spring Co-Op (Jan - June '27)

Our Cybersecurity team is looking for a co-op to work alongside security, engineering, and product stakeholders on three initiatives that matter to how our products reach the market and how the business recovers when something goes wrong: EU Cyber Resilience Act (CRA) readiness, data security posture remediation, and cyber resilience testing.

This is a hands-on role where you will be expected to take initiative while working under the guidance of a senior resource. You will own recurring follow-up, track findings to closure, and be the person who knows the current status when someone asks. You will leave with practical exposure to product security regulation, data security tooling, and resilience testing - experience that maps directly to GRC, product security, and security operations careers.

This position is for Winter/Spring (January - June) timeframe.

EU Cyber Resilience Act (CRA) compliance support

• Support project activities across the CRA readiness program, including requirement mapping, evidence collection, and gap tracking.
• Help maintain project artifacts - requirement traceability, action item logs, meeting notes, and status materials for stakeholders.
• Research CRA obligations and guidance, and summarize how they apply to specific product lines for technical and non-technical audiences.
• Coordinate with product, engineering, and legal contacts to chase down open items and keep deliverables on schedule.

DSPM finding remediation follow-up

• Triage findings from our Data Security Posture Management (DSPM) tool and route them to the right data or application owners.
• Drive remediation follow-up: confirm ownership, track due dates, escalate aging items, and verify closure.
• Spot patterns across findings and recommend root-cause fixes rather than one-off remediation.
• Build and maintain reporting on remediation progress, aging, and recurring issue themes.

Cyber resilience and recovery testing

• Track cyber resilience initiatives from kickoff to completion, keeping owners, milestones, and dependencies current.
• Support planning and execution of recovery tests - scheduling, participant coordination, and documenting scope and objectives.
• Capture test results, document findings and lessons learned, and follow corrective actions through to closure.
• Help improve resilience documentation, including runbooks, test plans, and after-action reports.

We care more about how you think and follow through than about a specific course list. Strong candidates will bring:

• Self-starter mindset - you take an ambiguous assignment, figure out the next step, and move it forward without waiting to be asked.
• Critical thinking - you ask why a finding exists, question assumptions, and can tell the difference between a real risk and noise.
• Strong written and verbal communication - you can write a clear status update, run a follow-up conversation with an engineer or a manager, and translate technical detail for a non-technical audience.
• Organization and follow-through - you keep many open items moving in parallel and nothing quietly falls off the list.
• Comfort with ambiguity and a genuine interest in cybersecurity, regulatory compliance, or risk management.

Qualifications

• Currently enrolled in an undergraduate or graduate program - cybersecurity, computer science, information systems, engineering, risk management, or a related field. Other majors with demonstrated security interest are welcome.
• Available for a full-time, six-month co-op term.
• Working proficiency with standard productivity and collaboration tools (spreadsheets, documents, presentations, ticketing or project tracking systems).

• Coursework, certification progress, or project experience in security, cloud, GRC, or data privacy (e.g., Security+, cloud fundamentals, CRA/NIS2/GDPR or NIST/ISO 27001 familiarity).
• Exposure to data security concepts such as classification, access control, or encryption.
• Experience organizing data or building reports - Excel, SQL, Python, or BI tools.