Sky Mavis - Security Operations Intern

• Security awareness program (primary focus) • Design and author the security awareness training curriculum: modules and quiz banks covering phishing and social engineering, password and MFA hygiene, data handling and classification, secure remote work, and Web3-specific threats (wallet security, seed phrase protection, approval scams, fake dApps). • Map each training module to the compliance requirements it satisfies (SOC 2 CC1/CC2, ISO 27001 A.6.3 awareness controls) so auditors can trace evidence to controls. • Operate the training program day-to-day: enroll employees, configure module deadlines and renewal cycles, monitor completion rates, and chase stragglers with the People team. • Produce audit-ready reporting: completion evidence exports, on-chain verification links for auditors, and periodic metrics for the security team (completion %, average scores, weakest topics). • Use quiz analytics to find knowledge gaps and iterate on content — treat awareness as a measurable security control, not a checkbox. • Document program runbooks (onboarding a new hire, adding a module, annual renewal campaign, audit evidence collection) so the program survives beyond the internship. • Platform delivery (the tool you'll run the program on) • Implement the platform from the existing specification under senior review: Solidity contracts (completion tracker + soulbound certificate NFT), Express/TypeScript/PostgreSQL backend with server-side quiz scoring and signed attestations, and the React frontend (module player, quiz flow, dashboards, admin analytics, public certificate verification). • Test and harden it: contract tests (100% must pass), backend integration tests, and the project's mandatory security-audit and business-logic checks before every PR — zero Critical/High findings before deploy. • Deploy, then support. • What We Look For • What We Look For • Final-year student or recent graduate in Information Security, Computer Science, or a related field (or equivalent practical experience). • Solid security fundamentals: common attack vectors (phishing, social engineering, credential theft, malware delivery), basic OWASP Top 10 awareness, and why the human layer is a primary attack surface. • Solid security fundamentals: • Genuine interest in security awareness and security operations: you can explain what makes training effective versus checkbox compliance, and you care about measuring behavior change, not just completions. • Genuine interest in security awareness and security operations: • Familiarity with a compliance or control framework (SOC 2, ISO 27001, NIST CSF) • Working programming ability in TypeScript/JavaScript (Node.js, REST APIs, basic SQL, basic React) — enough to implement from a detailed specification with senior review and AI-assisted tooling. This is a build-and-operate role, not a research role. • Working programming ability in TypeScript/JavaScript • Strong written communication: you will author training content and audit documentation that non-technical employees and external auditors will read. • Interest in Web3 security — wallet threats, on-chain verification — with motivation to learn Solidity basics quickly (prior experience not required). • Web3 security • Understanding of Git workflows (branching, pull requests, code review).