Defensive Application Security Internship

NVISO is a pure-play cyber security consulting firm: our team is composed of security professionals who each have their specific field of expertise ranging from Information Security Governance Risk & Compliance to Incident Response Penetration Testing CSIRT/SOC Software Security and Training & Awareness. This fantastic blend of skills enables us to help organizations prevent detect and respond to complex security challenges.

Threat modeling is a structured security exercise that maps a systems architecture including its components data flows and trust boundaries to identify where an attacker could realistically cause harm (i.e. attack surface) and what controls should exist to stop them. The output is typically a report describing threat scenarios assumptions and recommended mitigations. Within the Application Security team threat modeling plays this central role: catching architectural weaknesses and attack paths before they become incidents.

At NVISO we have created a Continuous Threat Modeling (CTM) toolbox that integrates threat awareness directly into CI/CD pipelines. The toolbox allows for continuous evaluation of the clients environment while it evolves turning a point-in-time exercise (i.e. static threat modeling assessment) into continuous value.

As the CTM toolbox is still in its early stages it lacks maturity for deployment in real-world client environments. This internship focuses on extending and improving the internal Continuous Threat Modeling (CTM) toolbox with agentic functionalities and a database of generalized policy as code.

While policies can be used by humans to reason if a system has some desired properties they lack the details for a machine to automatically check those properties. Policy as code is the bridge between the two for example by pattern matching a codebase with predefined rules organized by technology.

As an intern you will extend the CTM toolbox with:

• A generalized plug-and-play Policy as Code database that can be validated against a clients IaC.

• Agentic AI functionalities powered by NVISOs internal LLM embedded into the relevant phases of the toolbox.

The internship will be structured into three main tasks:

Task A Discovery

The first step is to gain a thorough understanding of the internals of the CTM toolbox identify agentic possibilities within the different phases of the toolbox and perform research on relevant frameworks / benchmarks that can be used for the Policy as Code database.

You will:

• Map the current CTM toolbox architecture: existing modules data flows CI/CD

integration points and the Threat-Model-as-Code schema it consumes / produces.

• Identify candidate phases for agentic functionality (e.g. automatic policy selection based on the threat model triage/prioritization of violations natural-language

remediation suggestions mapping drift findings back to threat scenarios) and document trade-offs for each.

• Research and benchmark relevant compliance frameworks and benchmarks (e.g. CIS Benchmarks NIST 800-53 OWASP Cloud/ASVS CSA CCM) and recommend which best fit the toolboxs scope.

Deliverable for this task: a short discovery write-up covering the CTM toolbox internals a shortlist of agentic touch points with pros/cons and recommended policy frameworks selection.

Task B Generalized Policy as Code Database

The goal is a client-agnostic reusable set of policies (rules validated against IaC) that plugs directly into the CTM toolbox rather than being written per-engagement.

You will:

• Define a policy structure and stable naming convention (e.g. POL-CIS-AWS-S3-01) consistent with the toolboxs existing Threat-Model-as-Code identifiers (e.g. TS-AUTH-01) so policies can be traced back to threat scenarios and controls.

• Author/curate policies in the chosen policy-as-code language from Task A organized by framework cloud provider/resource type and severity.

• Add metadata per policy: source framework/control reference applicability tags severity and remediation guidance.

• Build a validation/test harness with fixture IaC snippets (pass/fail cases) to prove each policy behaves correctly and to catch regressions.

• Ensure the database is versionable diff-friendly and documented.

Deliverable for this task: a versioned plug-and-play policy-as-code repository with framework/control mapping and a validation harness.

Task C Agentic AI Integrations

With the toolboxs phases mapped (Task A) and a policy database ready (Task B) the goal is to make the CTM toolbox smarter by inserting AI-assisted steps.

You will:

• Design agent(s) and skill(s) for one or more of the phases identified in Task A.

• Implement the agentic logic using NVISOs internal LLM (token/access provided) including prompt design any tool-calling and guardrails against hallucinated or unsafe outputs (e.g. an agent must never invent non-existing technologies used within the clients environment).

• Add a human-in-the-loop or confidence-scoring mechanism so AI outputs are auditable rather than blindly trusted.

• Integrate the resulting module(s) into the existing CTM toolbox flow.

Deliverable for this task: several working AI-assisted modules integrated into the CTM toolbox with documented prompts guardrails and evaluation notes.

The result Consolidation & Demo

The final step is to bring Tasks A B and C together into a coherent demonstrable extension of the CTM toolbox.

The starting point of this internship is a proof-of-concept toolbox created in a previous internship that takes converts a threat modeling report into a structured Threat-Model-as-Code (YAML) format and can detect architecture / IaC drift. The end-goal is to make the proof-of-concept ready to be deployed within real-world client environments by equipping it with a generalized policy-as-code database and agentic AI capabilities.

You will demonstrate how:

• A given architecture / IaC input is matched against the generalized policy database (optionally with AI-assisted policy selection).

• Policy checks execute and produce findings which the agentic layer triages/prioritizes and links back to threat scenarios.

• The whole flow runs inside the existing CTM toolbox / CI-CD context end to end on a realistic example.

Final deliverable:

• A complete generalized policy-as-code database mapped to recognized frameworks and pluggable into the CTM toolbox.

• Functioning AI integrations in the relevant CTM phases using NVISOs internal LLM.

• Clear documentation covering architecture how to extend the policy database agent design/guardrails and limitations.

• A working end-to-end demo showing the extended toolbox in action.

• Analyze the internal CTM toolbox architecture and identify agentic opportunities.

• Research and select policy-as-code frameworks standards and engines.

• Design and build a generalized pluggable policy-as-code database with framework traceability.

• Implement AI-assisted functionalities using NVISOs internal LLM with appropriate guardrails.

• Validate policies against sample IaC and test agent outputs for reliability.

• Document architecture usage and extension roadmap.

• Present findings and a live demo to NVISOs Application Security team.

• Currently pursuing a degree in Computer Science Cybersecurity Software Engineering or a related field.

• Programming skills in Python (or similar scripting language).

• Familiarity with Infrastructure-as-Code (e.g. Terraform Kubernetes) and/or policy-as-code tooling (OPA/Rego Checkov tfsec Sentinel).

• Basic understanding of CI/CD concepts.

• Interest in application security cloud security DevSecOps or AI/LLM-based automation.

• Analytical mindset and structured thinking.

• Ability to work independently while collaborating with consultants.
  

Nice to have:

• Familiarity with compliance/security frameworks (e.g. CIS Benchmarks NIST).

• Experience with GitHub Actions or GitLab CI.

• Prior exposure to prompt engineering tool-calling or LLM agent design.

By the end of the internship the intern will have:

• Built a generalized framework-mapped policy-as-code.

• Extended NVISOs CTM toolbox with working agentic AI capabilities.

• Gained hands-on experience with industry policy-as-code frameworks and engines.

• Worked directly with NVISOs internal LLM to build real production-oriented security tooling.

Beyond technical skills the intern will understand how security consulting deliverables can be operationalized in DevOps environments how assumptions degrade over time and how automation can preserve security posture continuously.

• Location: Brussels Belgium

• Working model: Hybrid

• Start date: From February 2027

• Duration: Minimum 3 months

• Unpaid internship

• Eligibility: You must be eligible to work in Belgium and meet the eligibility conditions applicable to this assignment.

• University agreement: This internship must be part of your academic programme and covered by an internship agreement with your university.

• Support: You will be supported by a dedicated NVISO mentor throughout your internship.

• Future opportunities: A successful internship may lead to further opportunities at NVISO after graduation depending on mutual fit and available positions.