More than simply a way to gain experience and pad your resume, summer internships often turn into job offers from those businesses and organizations once students complete grad school. And students who have just begun a master’s degree program in cybersecurity should start looking for a summer internship, well, now.
“September, October, a lot of corporate budgets are getting set, and every year, it seems earlier and earlier in the school year when companies or agencies are looking for interns,” says Josh Pauli, department head of cyber, intel, and info operations at the University of Arizona’s College of Applied Sciences and Technology.
For students pursuing a master’s degree in cybersecurity, these summer internship opportunities can range across the board, according to Jimmie Lenz, director of the master’s of engineering in cybersecurity and master’s of engineering in fintech programs at Duke University’s Pratt School of Engineering. “We have people working for government agencies over the summer, we have people working for some of the big private companies.”
As the field of cybersecurity continues to grow at an astronomical rate—Cybersecurity Ventures, a researcher and publisher that covers the international cyber economy, estimates there will be 3.5 million unfilled cybersecurity jobs by 2025—how can a cybersecurity master’s student land a summer internship, and what should they look for? Here’s what two experts told Fortune.
When considering a summer internship, Lenz says applicants should try to figure out which aspect of cybersecurity they want to work within, then apply for positions in that concentration. Still, he recommends that students not limit themselves to just one field of cybersecurity.
“You can enter in a lot of different places,” Lenz says. “You may want to be a [chief information security officer] in an energy firm, but don’t constrain yourself to just energy firms. Look at all kinds of firms, because you don’t know where the internships are available.”
Similarly, you may want to apply to several internships, even if it seems like you’re a shoo-in for an internship with your dream employer, recommends Pauli.
“Be really honest with yourself about the type of work that you think you want to do,” Pauli says. “What are the top three or four areas of cybersecurity that you want to do? Not the ones that make the headlines necessarily, or what your classmates want to do, or what you think is the highest demand, but the actual work that you would enjoy.”
Secondarily, he says, it’s important to find an internship with the type of employer you want to work for. Do you want the stability of a role in the government or an established corporation? Do you like the risks and potential rewards of working for a start-up? What about working in-person, remote, or hybrid? Whatever the case, Pauli recommends students begin their internship applications shortly after their first fall semester starts.
Networking can be key to landing an internship. Seminar speakers and capstone classes, along with contact with alumni of a cybersecurity program, can offer networking opportunities that students can take advantage of, Lenz says. These contacts can help students have a better grasp of what internships are available—as some internships aren’t publicly posted—and learn more about what these roles entail.
So what are employers looking for in their internship candidates? According to Lenz, businesses and organizations want interns who can understand cybersecurity in both the macro and micro sense.
“I hear more and more from [the] industry that technical experience is great, but if you don’t have a good understanding of the legal, policy, and regulatory side of things, that’s going to hamper your advancement,” Lenz says. “If you do have a good understanding of those things, it’s going to hasten your advancement.”
While some employers seek out candidates with a broad knowledge of cybersecurity, others are looking for interns with concentrated expertise, Pauli adds. “Some places are looking for industry certifications; some are looking for very, very specialized coursework, maybe in a technical area.”
When applying to an internship, Lenz stresses the importance of having a resume that looks professional. Applicants should adapt their resumes, or curriculum vitae (CV), to fit what a company or organization is looking for, he adds.
“Students often confuse the CV that they used to apply for grad school [with] the CV they should be using to apply for jobs,” Lenz says. “Make sure that your CV aligns with what the role is. You shouldn’t have the same CV for every role that you’re applying for. You want to highlight what’s being hired for.”
While the cybersecurity internship market is competitive, Lenz said that 100% of his cybersecurity master’s students at Duke had internships this summer.
“You see the numbers out there, the number of openings for cybersecurity professionals, and the forecasted number of openings for cybersecurity professionals continues to grow,” Lenz says. “The demand continues to grow, and I don’t see that abating any time [soon].”
Anecdotally, Lenz says it’s very common for employers to offer their summer interns a job before they graduate. But just because an employer extends a job offer your way, it doesn’t mean you have to take it. And even a bad internship experience has value, Pauli adds.
“It’s a perfect 100-day test drive,” Pauli says. “They get to test drive you, and you get to test drive them as an organization. The majority of [job] placements are the fruit of an internship that was a positive experience. It’s a huge step. It’s a huge differentiator for a student.”
See how the schools you’re considering fared in Fortune’s rankings of the best master’s degree programs in data science (in-person and online), nursing, computer science, cybersecurity, psychology, public health, and business analytics, as well as the doctorate in education programs MBA programs (part-time, executive, full-time, and online).
