Cybersecurity internships: US programs and where to apply

Start your cybersecurity internship search with employer career pages and student-program pages, then check the specific placement before you apply. Your student status, availability and work location can matter as much as the skills on your resume.

This guide focuses on US opportunities. It brings together two current employer adverts, a federal summer-program route and a university program to watch. We checked these sources on 27 September 2026. Applications can close or change, so open the linked page again before preparing your submission.

Cybersecurity internship options to check

An advertised vacancy gives you a role to investigate now. A program page explains a route, but you still need to find its current application. A future-intake announcement belongs on your watchlist.

These are places to investigate, rather than a ranking of employers. We haven't assessed the quality of their supervision or the experience of previous interns.

HNI: compare operations and GRC in one advert

HNI's summer 2027 cybersecurity advert describes two placements: one in security operations and one in governance, risk and compliance. Operations work includes monitoring and investigation support; GRC work includes reviewing controls and documenting security processes.

The advert asks for a relevant bachelor's or master's degree in progress and a minimum 2.8 GPA. It says it cannot accept candidates who require company sponsorship to work legally in the United States. Read that condition before investing time in an application.

HNI describes the internship as paid. Housing may be available depending on geographic need and capacity, so don't budget on receiving it until confirmed. The page we checked did not state a closing date or pay amount.

Liberty Mutual: look beyond the security-team label

The Cybersecurity & Technology Audit Internship at Liberty Mutual, reference 2026-126990, sits within Finance & Accounting. Its work includes interviewing staff, testing controls, assessing risks and communicating findings. A department label alone would miss its relevance to security assurance.

The summer 2027 placement requires an 11-week full-time commitment. The advert lists zero to two years of professional experience and a bachelor's degree in progress in Business Management, MIS, Computer Science or equivalent training, with a minimum 3.0 cumulative GPA. Excel and communication skills also appear in its requirements.

Boston and Portsmouth are listed. Confirm attendance expectations and the compensation terms directly; the page's general workplace-flexibility language doesn't establish that this particular internship is remote. We didn't find a closing date in the advert.

NSA: use the program page to find the right application

The NSA student-program page describes paid 12-week summer internships for 2027, with cybersecurity among its technical focus areas. It says college students can begin applying on 15 August and directs applicants to its job board.

Treat that as a route into the application system. It doesn't establish that every specialty or location still has an open place. Open the specific announcement, check its deadline and read the agency's hiring FAQs before deciding whether to apply.

The same site describes co-ops, scholarships and high-school work-study options. Check the section for your intended program carefully: a co-op that alternates work and study terms is a different commitment from a summer placement.

ASU: keep a future research program on your watchlist

ASU's Cybersecurity and Trusted Foundations internship page says its high-school program is planned to return in summer 2027 after a pause in 2026. It identifies Phoenix-area high-school students as its audience and says the page will be updated when the revised opportunity opens.

This is a future program to monitor, not a confirmed open application. Don't treat older descriptions of its duration or projects as final terms for the redesigned intake. Record a date to revisit the page, then check the new eligibility, schedule and application instructions when they're published.

Check eligibility before preparing an application

Read the requirements in two passes. First establish whether you can take the placement. Then decide how to demonstrate your fit for the work.

Check these practical conditions before tailoring your resume:

• Enrollment and graduation date. Does the employer require current enrollment, a particular degree stage or a return to study after the internship? Read any stated graduation window literally.
• Work location. Can you attend the required workplace? A company with remote employees may still run its internships in person. Ask about arrangements when the advert doesn't say.
• Work authorization and screening. Read the employer's conditions, including any citizenship, sponsorship or clearance requirements. If your circumstances are unclear, use the employer's recruiting contact and your institution's relevant adviser rather than assuming eligibility.
• Dates and hours. Compare the full placement with exams, classes and other commitments. Record the internship's start date separately from the application deadline.

Keep mandatory conditions separate from preferences. A preferred project or tool gives you something to discuss; an explicit minimum GPA or enrollment requirement is a different kind of condition. Don't quietly relabel either one to make an opportunity fit.

For an internship tied to academic credit, ask your institution what approval and supervision it requires. Employer acceptance and academic approval are separate decisions.

Search for the work you want to learn

Use the work itself to expand your search. Alongside “cybersecurity intern” and “information security intern,” try a few terms that match your interests:

These are search suggestions, not promises that every title is available today. Read the duties before ruling a role in or out. “Security” can refer to physical security, and a technology internship can include only a small amount of security work.

Use your college's careers office or placement team alongside public job searches. Ask which employers recruit through the institution and whether there are campus IT or research opportunities you can apply for. Follow interesting results to the employer's own advert and save its reference number so you can find it again.

A job simulation is useful practice, but label it accurately

Some searches return online exercises branded with an employer's name. Forage describes its job simulations as self-paced learning tasks and explicitly distinguishes them from internships.

You can use a simulation to explore a type of work. On your resume, describe the activity as a simulation or project, including the task you completed. Don't present it as employment by the company whose scenario you used. A completed exercise and an offer for a supervised placement are different outcomes.

If you aren't eligible for student placements, review the requirements of junior roles and cybersecurity apprenticeship routes as well. Each program sets its own entry conditions; an internship isn't the only route worth investigating.

Prepare evidence that matches the placement

Choose something you can explain clearly and connect it to a duty in the advert. That could be coursework, a personal project, a student-club responsibility or relevant work experience. You don't need to turn every application into a list of security products you've encountered.

For an operations placement, a practice investigation could show how you recorded observations and separated evidence from assumptions. For assurance work, a small mock review could show how you checked a requirement against supplied records and described an unresolved issue.

The following are illustrative project descriptions, not achievements to copy as your own:

Personal lab: reviewed a small set of sample sign-in events, wrote down the sequence and recorded what additional information would be needed before reaching a conclusion.

Coursework exercise: compared a fictional account register with an access policy, documented a mismatch and wrote a follow-up question for the account owner.

Use only authorized practice environments and data you can share. A portfolio should explain your work without exposing someone else's account information, internal records or employer material.

For each example, prepare a short explanation: what you were trying to understand, what you did, what you found and what remained uncertain. Expect to explain the choices you made. If a tutorial supplied most of the steps, say so and identify what you changed or learned.

Our cybersecurity resume examples show ways to present different backgrounds. The GRC and security analyst comparison can help you choose which kind of work to explore. Neither replaces the requirements of the specific internship.

Before buying a certification, check whether your target placements require one. Don't postpone an otherwise suitable application merely to complete a credential the employer hasn't requested.

Build a shortlist you can act on

Keep a small record for each opportunity. The point is to know your next action without reopening every page from scratch.

Employer, program and reference:
Official source and date checked:
Status: advertised vacancy / program route / future intake
Duties I want to learn:
Required enrollment, qualifications and eligibility:
Location, attendance and hours:
Application deadline and timezone, if stated:
Placement dates:
Pay and support confirmed / still to clarify:
Evidence I can honestly show:
Next action: apply / clarify a condition / revisit on a date

Leave missing information marked “not stated” or “to confirm.” A blank deadline is not evidence that an employer will accept applications indefinitely.

Consider this fictional comparison. Morgan is a student who can relocate for the summer and has a documented coursework review to discuss. Their next step is to check an assurance internship's mandatory conditions, then tailor the application around that evidence. Riley is a high-school student outside Phoenix who notices ASU's future program. The announced audience doesn't currently match Riley's situation, so Riley continues looking locally rather than planning around an unconfirmed exception.

This keeps research connected to a decision. You can be interested in a program without treating it as an available option.

Questions to ask before accepting an internship

Use an interview or offer discussion to understand how the placement will work. Ask who will supervise you, what a first assignment might involve and how your work will be reviewed. Find out how interns ask for help when their supervisor is unavailable.

Then confirm the practical terms: working hours, attendance, pay basis, equipment, any housing or travel support, and the dates you must commit to. If academic credit matters, resolve the institution's requirements before accepting. General benefits pages may describe permanent employees rather than interns, so ask which terms apply to your offer.

You can also ask how the employer considers interns for later roles. Treat a possible return offer as a possibility, not a guarantee built into the internship.

Choose one suitable advert to read closely today, record its unanswered questions and prepare one relevant example of your work. For a broader search, browse Cybersecurity Jobs List and inspect each employer's requirements. Keep future programs on a separate list so you can return when applications open.