Defensive Application Security Internship

Internship summary

NVISO is a pure-play cyber security consulting firm: our team is composed of security professionals who each have their specific field of expertise, ranging from Information Security Governance, Risk & Compliance to Incident Response, Penetration Testing, CSIRT/SOC, Software Security, and Training & Awareness. This fantastic blend of skills enables us to help organizations prevent, detect, and respond to complex security challenges.

Threat modeling is a structured security exercise that maps a system's architecture, including its components, data flows, and trust boundaries, to identify where an attacker could realistically cause harm (i.e., attack surface), and what controls should exist to stop them. The output is typically a report describing threat scenarios, assumptions, and recommended mitigations. Within the Application Security team, threat modeling plays this central role: catching architectural weaknesses and attack paths before they become incidents.

At NVISO, we have created a Continuous Threat Modeling (CTM) toolbox that integrates threat awareness directly into CI/CD pipelines. The toolbox allows for continuous evaluation of the client’s environment while it evolves, turning a point-in-time exercise (i.e., static threat modeling assessment) into continuous value.

As the CTM toolbox is still in its early stages, it lacks maturity for deployment in real-world client environments. This internship focuses on extending and improving the internal Continuous Threat Modeling (CTM) toolbox with agentic functionalities and a database of generalized policy as code.

While policies can be used by humans to reason if a system has some desired properties, they lack the details for a machine to automatically check those properties. Policy as code is the bridge between the two, for example by pattern matching a codebase with predefined rules, organized by technology.

As an intern, you will extend the CTM toolbox with:

• A generalized, plug-and-play Policy as Code database that can be validated against a client's IaC.

• Agentic AI functionalities, powered by NVISO's internal LLM, embedded into the relevant phases of the toolbox.

The internship will be structured into three main tasks:

Task A – Discovery

The first step is to gain a thorough understanding of the internals of the CTM toolbox, identify agentic possibilities within the different phases of the toolbox, and perform research on relevant frameworks / benchmarks that can be used for the Policy as Code database.

You will:

• Map the current CTM toolbox architecture: existing modules, data flows, CI/CD

integration points, and the Threat-Model-as-Code schema it consumes / produces.

• Identify candidate phases for agentic functionality (e.g., automatic policy selection based on the threat model, triage/prioritization of violations, natural-language

remediation suggestions, mapping drift findings back to threat scenarios) and document trade-offs for each.

• Research and benchmark relevant compliance frameworks and benchmarks (e.g., CIS Benchmarks, NIST 800-53, OWASP Cloud/ASVS, CSA CCM) and recommend which best fit the toolbox's scope.

Deliverable for this task: a short discovery write-up covering the CTM toolbox internals, a shortlist of agentic touch points with pros/cons, and recommended policy frameworks selection.

Task B – Generalized Policy as Code Database

The goal is a client-agnostic, reusable set of policies (rules validated against IaC) that plugs directly into the CTM toolbox rather than being written per-engagement.

You will:

• Define a policy structure and stable naming convention (e.g., POL-CIS-AWS-S3-01) consistent with the toolbox's existing Threat-Model-as-Code identifiers (e.g., TS-AUTH-01), so policies can be traced back to threat scenarios and controls.

• Author/curate policies in the chosen policy-as-code language from Task A, organized by framework, cloud provider/resource type, and severity.

• Add metadata per policy: source framework/control reference, applicability tags, severity, and remediation guidance.

• Build a validation/test harness with fixture IaC snippets (pass/fail cases) to prove each policy behaves correctly and to catch regressions.

• Ensure the database is versionable, diff-friendly, and documented.

Deliverable for this task: a versioned, plug-and-play policy-as-code repository with framework/control mapping and a validation harness.

Task C – Agentic AI Integrations

With the toolbox's phases mapped (Task A) and a policy database ready (Task B), the goal is to make the CTM toolbox “smarter” by inserting AI-assisted steps.

You will:

• Design agent(s) and skill(s) for one or more of the phases identified in Task A.

• Implement the agentic logic using NVISO's internal LLM (token/access provided), including prompt design, any tool-calling, and guardrails against hallucinated or unsafe outputs (e.g., an agent must never invent non-existing technologies used within the client’s environment).

• Add a human-in-the-loop or confidence-scoring mechanism so AI outputs are auditable rather than blindly trusted.

• Integrate the resulting module(s) into the existing CTM toolbox flow.

Deliverable for this task: several working AI-assisted modules integrated into the CTM toolbox, with documented prompts, guardrails, and evaluation notes.

The result – Consolidation & Demo

The final step is to bring Tasks A, B, and C together into a coherent, demonstrable extension of the CTM toolbox.

The starting point of this internship is a proof-of-concept toolbox, created in a previous internship, that takes converts a threat modeling report into a structured Threat-Model-as-Code (YAML) format and can detect architecture / IaC drift. The end-goal is to make the proof-of-concept ready to be deployed within real-world client environments, by equipping it with a generalized policy-as-code database and agentic AI capabilities.

You will demonstrate how:

• A given architecture / IaC input is matched against the generalized policy database (optionally with AI-assisted policy selection).

• Policy checks execute and produce findings, which the agentic layer triages/prioritizes and links back to threat scenarios.

• The whole flow runs inside the existing CTM toolbox / CI-CD context, end to end, on a realistic example.

Final deliverable:

• A complete, generalized policy-as-code database, mapped to recognized frameworks and pluggable into the CTM toolbox.

• Functioning AI integrations in the relevant CTM phases, using NVISO's internal LLM.

• Clear documentation covering architecture, how to extend the policy database, agent design/guardrails, and limitations.

• A working end-to-end demo showing the extended toolbox in action.

Responsibilities

• Analyze the internal CTM toolbox architecture and identify agentic opportunities.

• Research and select policy-as-code frameworks, standards, and engines.

• Design and build a generalized, pluggable policy-as-code database with framework traceability.

• Implement AI-assisted functionalities using NVISO's internal LLM, with appropriate guardrails.

• Validate policies against sample IaC and test agent outputs for reliability.

• Document architecture, usage, and extension roadmap.

• Present findings and a live demo to NVISO's Application Security team.

Requirements

• Currently pursuing a degree in Computer Science, Cybersecurity, Software Engineering, or a related field.

• Programming skills in Python (or similar scripting language).

• Familiarity with Infrastructure-as-Code (e.g., Terraform, Kubernetes) and/or policy-as-code tooling (OPA/Rego, Checkov, tfsec, Sentinel).

• Basic understanding of CI/CD concepts.

• Interest in application security, cloud security, DevSecOps, or AI/LLM-based automation.

• Analytical mindset and structured thinking.

• Ability to work independently while collaborating with consultants.
  

Nice to have:

• Familiarity with compliance/security frameworks (e.g., CIS Benchmarks, NIST).

• Experience with GitHub Actions or GitLab CI.

• Prior exposure to prompt engineering, tool-calling, or LLM agent design.

Output of the internship

By the end of the internship, the intern will have:

• Built a generalized, framework-mapped policy-as-code.

• Extended NVISO's CTM toolbox with working agentic AI capabilities.

• Gained hands-on experience with industry policy-as-code frameworks and engines.

• Worked directly with NVISO's internal LLM to build real, production-oriented security tooling.

Beyond technical skills, the intern will understand how security consulting deliverables can be operationalized in DevOps environments, how assumptions degrade over time, and how automation can preserve security posture continuously.

Practical Information

• Location: Brussels, Belgium

• Working model: Hybrid

• Start date: From February 2027

• Duration: Minimum 3 months

• Unpaid internship

• Eligibility: You must be eligible to work in Belgium and meet the eligibility conditions applicable to this assignment.

• University agreement: This internship must be part of your academic programme and covered by an internship agreement with your university.

• Support: You will be supported by a dedicated NVISO mentor throughout your internship.

• Future opportunities: A successful internship may lead to further opportunities at NVISO after graduation, depending on mutual fit and available positions.

Interested? Send us your application!!