Advisory - Consulting, Cyber Defence | Off-Cycle Internship (Jan 2027 to Jun 2027)

About KPMG

At KPMG, your long-term future is every bit as important to us as it is to you. We aim to provide experiences that will stay with you for a lifetime through great training and development, working across functional sectors, mobility opportunities, and corporate responsibility volunteering activities. Our culture recognises hard work, encourages new ways of thinking, and embraces diversity and inclusion.

Technology underpins many of the most influential organisations in the world, creating opportunities for businesses to seek out new markets and drive transformational change. Despite rapid advances in technology, greater connectivity, and 24/7 global commerce, many organisations still struggle to achieve their business aspirations without feeling exposed to risks.

We believe that turning traditional thinking on its head and adopting a positive approach to managing risk helps organisations achieve their business aspirations.

Cybersecurity Team Overview

KPMG Cybersecurity professionals help clients address concerns across Confidentiality, Integrity, Availability, and Privacy of their technology, business systems, and information assets. Using a holistic view of how technology and business integrate, the Cyber team performs technology-risk focused assessments, technology compliance, IT/operational process reviews, and designs information risk and cyber security solutions.

Role: Ethical Hacker / Penetration Tester

We are looking for candidates to join a growing team to assist clients in KPMG Cyber Defence. We provide comprehensive security solutions including vulnerability assessment, application and network penetration testing, wireless and mobile security, cloud security evaluation, and system security testing. Our mission is to identify blind spots in defences and deliver in-depth assessments of previously overlooked weaknesses, specialising in red teaming (simulating real-world attacks) and purple teaming (enhancing collaboration between offensive and defensive security teams).

As an Ethical Hacker/Penetration Tester, you will use the latest techniques and tools to pre-emptively test and challenge cyber security defences for our clients. You will help simulate advanced threat scenarios through red and purple teaming exercises, supporting clients to redesign their defences to be more resilient against real-world cyber attacks.

Key Responsibilities

• Conduct comprehensive vulnerability assessments and penetration tests across diverse platforms, including web and mobile applications, networks, wireless systems, and cloud environments.
• Participate in purple and red teaming exercises to test client defences and provide actionable insights to improve security posture.
• Develop detailed technical reports outlining findings, vulnerabilities, and recommended mitigations.
• Present findings and technical recommendations to senior management and clients in a clear and concise manner.
• Continually research and stay up to date with the latest cybersecurity trends, tools, and techniques.

Qualifications

• Degree in Cybersecurity / Information Security; or
• Degree in Engineering with relevant skills/experience/aptitude to develop further in the field of cybersecurity; or
• Degree in Computer Science / IT with relevant skills/experience/aptitude to develop further in the field of cybersecurity.

Requirements / Desired Skills

• Familiarity with multiple operating systems, including Windows, Linux, and macOS, and their related security mechanisms.
• Familiarity with scripting and programming languages such as Python, JavaScript, Bash, or PowerShell.
• Understanding of web protocols such as HTTP, HTTPS, and SSL/TLS, and how to secure web applications.
• Knowledge of common vulnerabilities and exploitation techniques, including those listed in the OWASP Top Ten.
• Exposure to cloud computing environments such as AWS, Azure, or Google Cloud, with a basic understanding of cloud security best practices.
• Basic proficiency with penetration testing tools such as Nmap, Metasploit, Burp Suite, and Wireshark, and familiarity with Kali Linux.
• Understanding of large language models (LLMs) and their applications in cybersecurity.
• Certifications such as OSCP (Offensive Security Certified Professional), CRT (CREST Registered Penetration Tester), CPTS (Certified Penetration Testing Specialist), and CBBH/CWES (Certified Bug Bounty Hunter / Certified Web Exploitation Specialist) are highly desirable; candidates currently planning to pursue these certifications are encouraged to apply.
• Strong analytical and problem-solving abilities.
• Excellent communication skills, with the ability to explain complex technical information clearly.
• Eagerness to learn and adapt to new technologies and methodologies.
• A proactive approach to identifying and addressing security challenges.
• Keen interest in staying up to date with the latest cybersecurity trends and emerging threats.