Advisory - Consulting, Cyber Defence | Off-Cycle Internship 2026 (Jul 2026 - Dec 2026)

Ethical Hacker / Penetration Tester

KPMG Cyber Defence provides comprehensive security solutions, including vulnerability assessment, application and network penetration testing, wireless and mobile security, cloud security evaluation, and system security testing. Our mission is to identify blind spots in defences and offer an in-depth assessment of previously overlooked weaknesses. We specialize in red teaming to simulate real-world attacks and purple teaming to enhance collaboration between offensive and defensive security teams.

Overview

As an Ethical Hacker/Penetration Tester, you will utilize the latest techniques and tools to pre-emptively test and challenge cyber security defences for our clients. You will be at the forefront of simulating advanced threat scenarios through red and purple teaming exercises, helping our clients redesign their defences to be more resilient against actual cyber-attacks.

Responsibilities

• Conduct comprehensive vulnerability assessments and penetration tests across diverse platforms, including web and mobile applications, networks, wireless systems, and cloud environments.
• Engage in purple and red teaming exercises to rigorously test client defences and provide actionable insights into security posture enhancements.
• Develop detailed technical reports outlining findings, vulnerabilities, and recommended mitigations.
• Present findings and technical recommendations to senior management and clients in a clear and concise manner.
• Continually research and stay up to date with the latest cybersecurity trends, tools, and techniques.

Qualifications & Requirements

• Degree in Cybersecurity / Information Security; OR
• Degree in Engineering with relevant skills/experience or aptitude to develop in cybersecurity; OR
• Degree in Computer Science / IT with relevant skills/experience or aptitude to develop in cybersecurity.
• Familiarity with multiple operating systems (Windows, Linux, macOS) and their security mechanisms.
• Familiarity with scripting and programming languages (e.g., Python, JavaScript, Bash, PowerShell).
• Understanding of web protocols (HTTP, HTTPS, SSL/TLS) and how to secure web applications; knowledge of common vulnerabilities and exploitation techniques (OWASP Top Ten).
• Exposure to cloud environments (AWS, Azure, Google Cloud) and a basic understanding of cloud security best practices.
• Basic proficiency with penetration testing tools (Nmap, Metasploit, Burp Suite, Wireshark) and familiarity with Kali Linux.
• Understanding of large language models (LLMs) and their applications in cybersecurity.
• Certifications such as OSCP, CREST CRT, CPTS, CPTB/CWES are highly desirable; candidates planning to pursue these certifications are encouraged to apply.
• Strong analytical and problem-solving abilities.
• Excellent communication skills to relay complex technical information clearly.
• Eagerness to learn and adapt to new technologies and methodologies.
• Proactive approach to identifying and addressing security challenges.
• Keen interest in staying up-to-date on cybersecurity trends and emerging threats.