Job Description
Location: Hybrid · Level: Intern · Experience: Entry level
\n
\n
About Definity
\n
\n
Definity is a fast-growing technology company changing how organizations manage their contingent workforce. Our platform powers healthcare staffing, vendor management, credentialing, and workforce analytics at enterprise scale. Our engineering culture values quality, reliability, and fast delivery.
\n
\n
The Role
\n
We are working toward a SOC 2 report, and we are looking for a curious, detail-oriented intern to help build and run our security and compliance program. You will work directly with our security and compliance lead and see how security controls are designed, implemented, and audited at a real software company. This is a hands-on role with meaningful ownership, and your work will directly support our audit.
\n
\n
What You Will Do
\n
· Collect, organize, and maintain audit evidence for SOC 2 controls, including access reviews, change management, onboarding and offboarding, and backups.
\n
· Help draft, review, and update security policies and procedures, such as Access Control, Incident Response, Vendor Management, and Acceptable Use.
\n
· Maintain inventories of company assets, systems, and third-party vendors.
\n
· Support vendor risk assessments by gathering and reviewing vendors' SOC 2 reports and security questionnaires.
\n
· Prepare quarterly user access reviews across key systems for system owners to approve.
\n
· Track remediation items from vulnerability scans, penetration tests, and control gaps, and follow up with engineering until they close.
\n
· Help run our security awareness program: training completion, phishing simulations, and internal tips.
\n
· Keep our compliance platform up to date and flag failing tests.
\n
· Contribute to the risk register and help document risk assessments.
\n
· Help answer customer security questionnaires using approved documentation.
\n
\n
What You Bring
\n
· Current study toward a degree in cybersecurity, information systems, computer science, or a related field, or equivalent self-study or bootcamp experience.
\n
· A basic understanding of security concepts: least privilege, multi-factor authentication, encryption, logging, and incident response.
\n
· Strong written communication. Much of compliance work is clear documentation.
\n
· Strong organization, with the ability to manage many small tasks and follow up persistently.
\n
· Comfort with spreadsheets, ticketing tools, and cloud-based SaaS applications.
\n
· Discretion and good judgment with sensitive information.
\n
\n
Nice to Have
\n
· Familiarity with SOC 2, ISO 27001, NIST CSF, or CIS Controls.
\n
· Exposure to Azure, Microsoft 365, Entra ID, or Azure DevOps.
\n
· Coursework or certifications such as CompTIA Security+, the Google Cybersecurity Certificate, or ISC2 CC.
\n
\n
What Success Looks Like
\n
· You own a defined part of the program end to end, such as vendor management or the evidence library for access controls, and hand it over in a state the team can keep running.
\n
· Evidence for the controls you support is complete, organized, and ready before the auditor asks for it.
\n
· The policies, inventories, and risk assessments you produced are approved and in use.
\n
\n
Why Join
\n
· First-hand experience taking a company through a SOC 2 audit, a strong differentiator early in a security career.
\n
· Mentorship from our security and compliance lead, with exposure to engineering, IT, and leadership.
\n
· A portfolio of real work: policies, risk assessments, and process documentation.
\n
\n
Equal Opportunity Statement
\n
Definity is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by federal, state, or local law.