Security Engineer Internship

About this role

Security Engineer Overview: Supply Chain Security and Compliance The Security Engineer is a critical role responsible for implementing and enforcing robust security practices across our entire integrated supply chain e-commerce platform. You will safeguard e-commerce transactions, secure internal tool integrations, and establish the trust framework for our AI agent operations, ensuring compliance with global regulatory standards like PCI-DSS and GDPR.

Internship Details Duration: 3 months (extendable based on performance and project scope) Start Date: Immediate Location: Remote Stipend: Unpaid initially; may convert to a paid internship, full-time role, or even direct client absorption (FTE) based on your performance Key Responsibilities & Core Projects You will secure all layers of the application, from the Next.js frontend to the NestJS modular monolith and the cloud infrastructure.

Security Architecture & Threat Modeling: Perform vulnerability assessments, code reviews, and threat modeling for all new features and systems, focusing on the critical MES $\rightarrow$ WMS $\rightarrow$ OMS business process flow. Compliance Enforcement: Lead the implementation and auditing of security controls necessary for PCI-DSS compliance (for Payment module) and GDPR compliance (for user/tenant data handling). Access Control & Authentication: Implement and manage secure API authentication methods, including OAuth 2.0 and SAML, utilizing Authentik/Ory Kratos and leveraging PostgreSQL's Row-Level Security (RLS) for tenant isolation.

Secrets & Encryption: Manage secrets and key rotation using Vault, define and enforce encryption protocols for data both in transit and at rest, and manage certificates via Traefik. Abuse Prevention: Implement and monitor controls for API rate limiting, Web Application Firewall (WAF) rules, and traffic monitoring to prevent abuse and denial-of-service attacks. Incident Response: Develop and practice incident investigation and response protocols.

Conduct security awareness training for development and operations teams. Required Technologies & Tools Candidates must possess hands-on security experience with our core stack and compliance tools: Platform Security: Node.js/NestJS security best practices, Next.js/React security, PostgreSQL RLS. Compliance Focus: Experience with PCI-DSS and GDPR controls and auditing. Authentication & Access: OAuth 2.0, SAML, JWT, Authentik/Ory Kratos.