Defensive Application Security Internship

Internship summary

NVISO is a pure-play cyber security consulting firm: our team is composed of security professionals who each have their specific field of expertise, ranging from Information Security Governance, Risk & Compliance to Incident Response, Penetration Testing, CSIRT/SOC, Software Security, and Training & Awareness. This fantastic blend of skills enables us to help organizations prevent, detect, and respond to complex security challenges.

Threat modeling is a structured security exercise that maps a system's architecture, including its components, data flows, and trust boundaries, to identify where an attacker could realistically cause harm (i.e., attack surface), and what controls should exist to stop them. The output is typically a report describing threat scenarios, assumptions, and recommended mitigations. Within the Application Security team, threat modeling plays this central role: catching architectural weaknesses and attack paths before they become incidents.

At NVISO, we have created a Continuous Threat Modeling (CTM) toolbox that integrates threat awareness directly into CI/CD pipelines. The toolbox allows for continuous evaluation of the client’s environment while it evolves, turning a point-in-time exercise (i.e., static threat modeling assessment) into continuous value.

As the CTM toolbox is still in its early stages, it lacks maturity for deployment in real-world client environments. This internship focuses on extending and improving the internal Continuous Threat Modeling (CTM) toolbox with agentic functionalities and a database of generalized policy as code.

While policies can be used by humans to reason if a system has some desired properties, they lack the details for a machine to automatically check those properties. Policy as code is the bridge between the two, for example by pattern matching a codebase with predefined rules, organized by technology.

As an intern, you will extend the CTM toolbox with:

• A generalized, plug-and-play Policy as Code database that can be validated against a client's IaC.

• Agentic AI functionalities, powered by NVISO's internal LLM, embedded into the relevant phases of the toolbox.

The internship will be structured into three main tasks:

Task A – Discovery

The first step is to gain a thorough understanding of the internals of the CTM toolbox, identify agentic possibilities within the different phases of the toolbox, and perform research on relevant frameworks / benchmarks that can be used for the Policy as Code database.

You will:

• Map the current CTM toolbox architecture: existing modules, data flows, CI/CD

integration points, and the Threat-Model-as-Code schema it consumes / produces.

• Identify candidate phases for agentic functionality (e.g., automatic policy selection based on the threat model, triage/prioritization of violations, natural-language

remediation suggestions, mapping drift findings back to threat scenarios) and document trade-offs for each.

• Research and benchmark relevant compliance frameworks and benchmarks (e.g., CIS Benchmarks, NIST 800-53, OWASP Cloud/ASVS, CSA CCM) and recommend which best fit the toolbox's scope.

Deliverable for this task: a short discovery write-up covering the CTM toolbox internals, a shortlist of agentic touch points with pros/cons, and recommended policy frameworks selection.

Task B – Generalized Policy as Code Database

The goal is a client-agnostic, reusable set of policies (rules validated against IaC) that plugs directly into the CTM toolbox rather than being written per-engagement.

You will:

• Define a policy structure and stable naming convention (e.g., POL-CIS-AWS-S3-01) consistent with the toolbox's existing Threat-Model-as-Code identifiers (e.g., TS-AUTH-01), so policies can be traced back to threat scenarios and controls.

• Author/curate policies in the chosen policy-as-code language from Task A, organized by framework, cloud provider/resource type, and severity.

• Add metadata per policy: source framework/control reference, applicability tags, severity, and remediation guidance.

• Build a validation/test harness with fixture IaC snippets (pass/fail cases) to prove each policy behaves correctly and to catch regressions.

• Ensure the database is versionable, diff-friendly, and documented.

Deliverable for this task: a versioned, plug-and-play policy-as-code repository with framework/control mapping and a validation harness.

Task C – Agentic AI Integrations

With the toolbox's phases mapped (Task A) and a policy database ready (Task B), the goal is