Internship Offers for the 2026-2027 Season

2026-10-15T00:00:00+02:00

🟢 Vulnerability assessment and exploitation of a Telematic Control Unit
🟢 Vulnerability assessment and exploitation of satellite communication systems
🟢 Protections against dynamic attacks for firmware
🟢 Development of tooling for fuzzing infrastructure
🟢 Fighting Dynamic Binary Instrumentation

We also welcome people with wide but realistic creativity, so if you have an idea and want to join the team, don't hesitate to reach out to discuss it with our experts!

Our goal is to publish most of the results of our internships. Here are some examples of publications from previous internships:

A blogpost on Starlink's User Terminal internals;
A SSTIC talk presenting crypto-condor, an open-source test suite for compliance testing of implementations of cryptographic primitives;
A Hardwear.io talk on Bluetooth Low Energy GATT Fuzzing;
A Black Hat EU talk on the Google Titan M chip;
A blogpost on Differential fuzzing for cryptography

Quarkslab's team is always pleased to welcome new talents who want to work on complex security research subjects. If you want to face new challenges and work in a dynamic environment where curiosity and teamwork are at the heart of our way to do R&D, please apply!

In particular, we would be very happy to welcome more applications from female candidates, and under-represented minorities. Quarkslab is dedicated to making the cybersecurity world more welcoming and inclusive for all, and that starts with our internships.

With that in mind, and because we know impostor syndrome is a big obstacle for women in particular -- we've been there -- don't hesitate to reach out to us at icandoit-AT-quarkslab-DOT-com to discuss your skills, and we will help you navigate our offers.

How to Apply?

To apply for an internship position, you must be a student, able to efficiently communicate on technical matters in written and spoken English, and willing to present the results of your internship to a large group of curious Quarkslab colleagues. Beforehand, you need to prepare the following elements:

A resume;
A cover letter: avoid the generic letter saying that you are so motivated and that we are so interesting. We welcome a more personal letter which explains why the topic is of particular interest to you, why you, and why us;
Your proposed solution to the assignment attached to the offer you are interested in.

Package these elements and send them via email to internship-AT-quarkslab-DOT-com, with the subject field containing the internship name mentioned in the respective offer.

Do not forget that the key aspect of a good application is being curious and motivated, not meeting all requirements listed in the offers below should not prevent you from sending us your application, and we can discuss your skills. Keep in mind that internships are meant for learning. Let's go!

Selection Process

Each internship offer comes with a little assignment that should not require too much time to be completed. The result will show us not only the type of skills and knowledge you already possess, but also how ingenious you are and how well you can present your reasoning. It will serve as the basis for the interview you will have in the selection process. The assignment works both ways and is also intended to make sure that you like the topic as well as the technical aspects of the internship. If unsure about a specific aspect of a challenge, do not hesitate to drop us an email. We are open to discussion!

The first applications usually reach us a few days after publication, and we start reviewing them right away. Some internships are filled before the end of the year, while others remain open until March.

Did you notice the colored circles next to the title of the offers at the top of this blogpost? They reflect the state of internships:

🟢 Waiting for applications;
🟠 Reviewing applications, we are still accepting internship assignments but hurry up;
🔴 Internship is filled.

Being an Intern at Quarkslab

Training and helping people grow in the security industry is part of the company's DNA. That is why we provide in-depth blogposts, tools, trainings, weekly internal conferences (called Fridaycon, guess when they are), we teach in universities and schools and write articles in tech magazines. Sharing is caring, but sharing is also learning. We provide the environment for that and the rest relies on you.

Intern package in France:

Salary: €1800 gross per month (approximately €1550 net);
"Tickets restaurant" (restaurant coupons);
In-depth and challenging topics.

Internships Topics

🟢 Vulnerability assessment and exploitation of a Telematic Control Unit

Description

Since 2016, every new model of vehicle sold in Europe should be equiped with an eCall module, that provides voice and data connectivity for emergency services. This was an important milestone in the connectivity of road vehicles, as manufacturer are using this data capability to enhance the driver experience, with live information, remote control, ...

Therefore, the telematic control module (TCU) is a key element in the security of a car, with a permanent 3GPP connectivity. From this perspective, questions arise:

Are these modules secure enough to prevent an attacker to get a remote access to a vehicle ?
What kind of data are transmitted to backend server, brokers, and what could be the impact from a privacy point of view ?

During this internship you'll focus on one or two telematic control unit, to get an understanding on how they work, analyze communications and evaluate the maturity of their security features.

Required Skills

ARM reverse engineering (intermediate)
Fuzzing (basic to intermediate)
Programming: Python, C

What you will do

The goals of this internship are:

Extract and analyse the operating system of a telematic control unit
Reverse-engineer targeted binary to understand how the device communicate with the backend
Analyze the TCU baseband

Assignment

Download the assignment.zip file and follow the instructions in assignment.md.

Duration

6 months

Location

Paris, France

🟢 Vulnerability assessment and exploitation of satellite communication systems

Description

This internship focuses on the practical security analysis of satellite communication systems, starting from the completion and operation of an existing ground station project.

The first objective will be to finalize the ground station setup and validate its ability to receive and process satellite signals. The intern will then use the station to capture and analyze real satellite communications, identify the protocols and implementations in use, and understand the different layers involved in the communication chain.

From these observations, the intern will study the security properties of the identified protocols and software implementations, map potential attack surfaces, and investigate possible weaknesses or vulnerabilities.

Depending on the results, the project may include reproducing known vulnerabilities, analyzing protocol weaknesses, developing test or fuzzing environments, and experimenting with potential attacks in a controlled environment.

The overall objective is to follow the complete path from signal acquisition to security research, combining radio communications, protocol analysis, reverse engineering and vulnerability research.

Required Skills

Programming: Proficiency in Python, C/C++, or similar languages.
Cybersecurity: Understanding of vulnerability research, reverse engineering, and security assessment techniques.
Networking & Protocols: Familiarity with communication protocols and packet analysis.
Research: Ability to investigate unfamiliar technologies, read technical specifications, and independently formulate hypotheses.
Radio/SDR knowledge: Familiarity with SDR or digital communications is appreciated but not mandatory.

Assignment

Choose a publicly documented vulnerability from 2022 or later affecting a space-related protocol, software component, ground station, or satellite communication system.

Rather than simply summarizing the CVE:

Analyze it: Explain where the vulnerable component fits within a realistic satellite communication architecture, the root cause, and what an attacker would realistically need to exploit it.
Investigate it: Perform a small technical experiment: analyze the vulnerable code and its patch, reproduce the behavior, build a test harness, craft an input reaching the vulnerable code path, or propose another relevant experiment.
Go beyond the documentation: Identify one question or hypothesis that is not answered by the CVE/advisory and explain how you would investigate it.

A successful exploit is not required. We are more interested in your technical reasoning, methodology, observations, and ability to investigate an unfamiliar system.

You may use AI tools during the assignment. Briefly indicate how you used them and describe at least one AI-generated suggestion or conclusion that you verified, corrected, or rejected, and explain why.

Duration

6 months

Location

Paris, France.

🟢 Protections against dynamic attacks for firmware

Description

If you like playing cat and mouse and getting your hands dirty, this internship is for you!

At Quarkslab, we have been developing application protection tools since 2014, featuring obfuscation and runtime application self-protection (RASP). One of these tools (QShield App Protection) relies on a compiler framework, LLVM, and comes as a replacement for the regular compiler used by our customers.

While desktop and mobile targets have been supported for several years, supporting embedded targets is more challenging, due to the variety of situations.

The goal of this internship is to ~~help the QShield team~~ improve ~~both~~ the level of protection for the IoT/embedded domain by developing sensors to detect dynamic attacks.

For that you will need to reproduce the setup of attackers, analyze the weaknesses of the tooling they use, and develop proof of concepts to detect them or prevent their usage. You will then integrate them in our software protection tooling.

Required Skills

Have an experience in building a firmware or a static library for an embedded device, and playing with compiler options.
Have some familiarity with either Arm32 or AArch64 instruction sets.
Be able to demonstrate experience developing in C.
Have an interest in compilers and software protection or security (you don't need to be an expert in compilation ;) ).

What you will do

During this internship, you will:

research and develop detection or counter measures for dynamic tools/techniques used to reverse-engineer embedded software such as JTAG/SWD debugging, emulation with QEMU, dynamic instrumentation, etc.;
integrate them into our coverage testing infrastructure which ensures that the sensors behave as expected in different environments;
work on the integration in the development toolchains to improve the user experience.

For that you will work with people with various skills, such as reverse-engineering, software development with huge code bases and testing them.

Assignment

Write a small bare-metal firmware for the Arm Cortex-M3 emulated by QEMU (qemu-system-arm -M mps2-an385). You don't need any hardware. Use any Arm toolchain (e.g. Arm Toolchain for Embedded or the GNU Arm toolchain), but no vendor SDK, HAL, IDE or RTOS.

The firmware must:

use your own linker script and startup code (vector table, reset handler);
print its output through the board's UART (not semihosting);
determine whether it runs on an emulator or on real silicon, using at least two independent checks, and print the verdict and the raw values it observed.

Send us a zip containing:

the sources;
a Makefile (or CMake) where make run builds and runs everything;
the ELF;
a report of 2 pages at most that:
explains the boot sequence of your firmware, from reset to main;
for each check: what it reads, the value seen under QEMU, the value you expect on a real Cortex-M3 with a reference to the Arm documentation, and how an attacker could get around it;
describes at least one check that did not work, and why;
lists the tools you used, LLMs included, and what you checked yourself.

This should take 3 to 4 hours. We don't expect a perfect detector: a check that fails, with a good explanation, is worth more than a long list of checks you can't explain.

If you're selected, you'll run the firmware during the interview and we'll change it together, look at the binary, and discuss how to bypass your checks.

Duration

6 months

Location

Paris, France

🟢 Development of tooling for fuzzing infrastructure

Description

Fuzzers produce a lot of output data and it can sometimes be hard to sift through the results. Furthermore, different fuzzing targets require different sets of tools which might not share output formats.

To face this, you will implement an aggregator that defines a common format for integrating fuzzing results into a unified dashboard. On top of displaying fuzzing campaign results, the goal of this aggregator is to triage bugs for efficient vulnerability research. The methodology will be different for each bug class and target, so the system shall be modular to allow for the integration of different types of fuzzers on different platforms.

Required Skills

Proficient in C, C++ for analyzing code, experienced in python, js, or others for development work
Deep understanding of fundamental bug classes in binary exploitation (buffer overflow, use-after-free, race condition, ...)
Good communication skills
Proficient in French and/or English

What you will do

Most of your work will be programming the dashboard with the help of LLMs when applicable. Alongside that, you will come up with ad-hoc strategies for automatically analyzing certain bug classes in a specific context and producing actionable insights.

Assignment

This assignment is mostly theoretical.and consists of two write ups:

A 5 page (maximum) document describing the state of the art of binary fuzzers. In this report, include a comparison of the different fuzzing methodologies available and their use-cases.
Pick any Android application that uses a native library to parse user-provided data, and write a small document on how you would fuzz that library.

Duration

6 months

Location

Paris, France

🟢 Fighting Dynamic Binary Instrumentation

Description

If you like playing cat and mouse and getting your hands dirty, this internship is for you!

At Quarkslab, we have been developing application protection tools (QShield) since 2014, featuring protections against static attacks (obfuscation) and dynamic ones.

Among the latter, Dynamic Binary Instrumentation (DBI) frameworks such as QBDI, Intel Pin, DynamoRIO, WinDBG TTD and Frida have become foundational tools in software security, enabling fine-grained runtime analysis, tracing, and modification of program execution without requiring source code.

While invaluable for legitimate purposes such as vulnerability research, malware analysis, and software testing, these same capabilities make DBI a powerful vector for reverse engineering, intellectual property extraction, and license or DRM circumvention when turned against commercial or sensitive software.

As a result, anti-DBI techniques have become a critical component of software protection strategies. However, developing robust anti-DBI protections faces substantial technical barriers. DBI frameworks operate at a privileged level close to the CPU and OS, making their artifacts (timing anomalies, memory layout changes, code cache behavior) subtle and inconsistent across platforms and versions.

The goal of this internship is to help the QShield team improve their current protections and develop new anti-DBI sensors.

For that you will need to reproduce the setup of attackers, analyze the weaknesses of several DBI frameworks, and develop proofs of concept to detect them or prevent their usage. You will then integrate them into our software protection tooling.

Required Skills

Be familiar with reverse-engineering.
Be able to demonstrate experience developing in C.
Have an interest in software protection or security.

What you will do

During this internship, you will:

research and develop detection or counter measures for DBI frameworks;
integrate them into our coverage testing infrastructure which ensures that the sensors behave as expected in different environments.

For that you will work with people with various skills, such as reverse-engineers, and the developers of huge code bases and their testing infrastructure.

Assignment

As a first step, you will develop a "hello world" Linux x64 binary that detects when it is being executed under this tracer.
As a second step, you will assess whether your solution still works if the tracer is modified to hide or alter the artifacts you rely on (for example a string identification), and propose a more resilient detection mechanism.

Expected outputs :

A PoC in source code form (feel free to use the language you want), that builds cleanly on a standard Linux environment (dockerfile accepted), with no manual tweaking required.
A write-up in Markdown explaining the choices made for the PoC and detailing the second part of the assignment.

Duration

6 months

Location

Rennes, France

Quarkslab's blog - DBI

Internship Offers for the 2026-2027 Season

How to Apply?

Selection Process

Being an Intern at Quarkslab

Internships Topics

🟢 Vulnerability assessment and exploitation of a Telematic Control Unit

Description

Required Skills

What you will do

Assignment

Duration

Location

🟢 Vulnerability assessment and exploitation of satellite communication systems

Description

Required Skills

Assignment

Duration

Location

🟢 Protections against dynamic attacks for firmware

Description

Required Skills

What you will do

Assignment

Duration

Location

🟢 Development of tooling for fuzzing infrastructure

Description

Required Skills

What you will do

Assignment

Duration

Location

🟢 Fighting Dynamic Binary Instrumentation

Description

Required Skills

What you will do

Assignment

Duration

Location