Cybersecurity internship: learning to protect within the authorised scope

Three main families of tasks

The word cybersecurity gives the impression of a single job, when it covers several families of roles. A serious internship offer should state which one it concerns.

Monitoring and incident response

Analysts examine the alerts raised by detection tools, decide whether they match a real incident and trigger the planned reactions. The work is often organised in teams, sometimes with shifted hours.

Audit and security testing

This means checking configurations, looking for known weaknesses and writing recommendations. These tests are only carried out within a scope defined in writing and authorised by the owner of the system.

Governance, risk and compliance

This side covers security policies, risk analysis, staff awareness, personal data protection and preparation for inspections. It looks less technical, but it is indispensable.

A legal framework to know before touching anything

Accessing a computer system without authorisation, staying in it or disrupting its operation can be a criminal offence, even out of curiosity and even without intent to harm. In France and in many other countries, this rule applies to a company website, a public application or your school's network.

For a student, the consequence is simple: you practise only on targets meant for that purpose, that is demonstration environments, exercise platforms or a personal lab. In a company, tests are carried out with written authorisation, a precise list of the systems concerned, agreed dates and a contact to warn.

Respect for data also comes into play. An intern may come across sensitive information, such as connection logs or customer data. They are bound by confidentiality, which is generally covered by a commitment signed on arrival.

Internship or apprenticeship: what changes in cybersecurity

An internship, formalised by an agreement with your school, offers an immersion of a few months. In France, beyond a certain length an allowance is due; its minimum amount is set by regulations and changes, so you need to check it at the time of signing.

An apprenticeship takes the form of an apprenticeship or professionalisation contract and puts you in the position of an employee. It is common in this sector, where companies want to train their own people, because the skills are acquired slowly and depend a great deal on the environment.

One particular feature: many specialist cybersecurity courses come after a first grounding in computing, networks or development. It is common to start with a vocational diploma or a university technology degree, then specialise in a professional bachelor's, a master's or an engineering school. In France, courses recognised by the national information systems security agency carry a label, which is useful for finding your way.

The basics to acquire before searching

A good beginner profile is recognised by the strength of its foundations more than by specialist vocabulary.

• Networks: how data travels, the role of a firewall, the principle of encrypting exchanges;
• Systems: permission management on Linux and Windows, logs, updates;
• Programming and scripts: reading a program, automating a check, spotting a risky practice;
• Security principles: confidentiality, integrity, availability, least privilege, defence in depth;
• Digital hygiene: passwords, strong authentication, phishing.

Add the ability to write clearly. An analyst who finds an anomaly must describe it so that others can deal with it: what was observed, the uncertainties, the possible consequences and the proposed action.

Practising legally and talking about it

Several means let you progress without stepping outside the framework. Online exercise platforms offer challenges designed to be solved, at graded levels. Student security competitions provide team challenges. A personal lab made of isolated virtual machines lets you study how a known weakness works and fix it.

To make this help your application:

1. choose two or three exercises and document your approach, not only the solution;
2. explain what you learned about defence, for example the measure that would have prevented the weakness;
3. state that everything took place on targets provided for that purpose;
4. avoid publishing exploitable details about real organisations.

A recruiter will notice this restraint, because it shows that you understand the ethics of the profession.

Where to look and whom to approach

Employers are numerous: consulting and audit firms, security operations centres, software vendors, banks and insurers, operators of essential services, IT services companies, local authorities and healthcare institutions. Each puts the intern in a different situation. With a service provider, you will see several clients in a short time; with an end user, you will follow one environment over time.

Draw on the contacts of your course, events run by cyber communities, job sites and unsolicited applications addressed to a head of security. In France, venues bringing together players in the sector unite companies, trainers and associations, which makes meetings easier. For a targeted application, mention the type of team you are aiming for, rather than a vague interest in hacking.

An illustrative example: analysing a signal without jumping to conclusions

A fictional example, for teaching purposes. Lina, a four-month intern in a monitoring team, receives an alert showing about ten failed login attempts on one account during the night.

Rather than talking about an attack, she starts by putting the signal in context: the account belongs to an employee travelling in another time zone, the attempts come from a single address, and no successful login followed. She notes these elements, states what she does not yet know and suggests to her supervisor that they contact the employee to check, then strengthen the account's authentication.

Her report runs to ten lines, separates facts from hypotheses and proposes an action within the authorised scope. This restraint is what makes an intern useful: a signal is presented as a signal until it is confirmed as an incident.

Common mistakes among candidates

• Presenting yourself as a hacker and boasting about exploits, which worries more than it reassures.
• Testing a real website to prove your level, at the risk of criminal penalties and closed doors.
• Neglecting the fundamentals of networks and systems in favour of spectacular tools.
• Underestimating writing: an unreadable report cannot be used.
• Not clarifying the focus of the internship before signing, and ending up on tasks unrelated to your career plan.
• Handling sensitive data outside the planned rules, for example copying logs to a personal computer.

Before starting, ask for the rules on access, confidentiality and who to contact in case of doubt. Good teams have already written them down.