Internship: RFK Solutionz (CYSE 368)

What this internship was and why it mattered

During Summer 2026 I completed my CYSE 368 internship with RFK Solutionz, a cybersecurity and IT services organization. It was the first time I applied my coursework, my Security+ certification, and tools like Nmap, Metasploit, Burp Suite, Wireshark, Nikto, and Hashcat in a real organization. It also broadened what I thought cybersecurity was, beyond offensive security into compliance, infrastructure, and education.

The work

IT deployment: hardware setup, workstation deployment, and OS configuration, including researching and recommending an OS upgrade.

CMMC compliance research: structured CMMC Level 1 and Level 2 documentation covering scoping, external and cloud service provider considerations, domain requirements, and a six-phase compliance action plan.

Offensive security: co-developed an offensive security presentation and Capture the Flag challenge with a fellow intern, and did privilege-escalation testing and physical access control research.

Cyber Academy: helped plan and deliver game-based cybersecurity activities for about 50 K–12 students, including teaching a full class session on my own.

Selected evidence

Reflection Papers 1–3. These track the internship as it happened. I included them because they show how my thinking changed week to week, especially how the compliance work pulled me in more than I expected.

Final Paper. This is the full picture of the internship and what I took from it. If you only open one, open this one.

Reflection

The compliance research was the hardest part, not because it was technically difficult, but because CMMC documentation has no single right answer. Scoping decisions depend on judgment calls about risk that I had to defend, not just look up. Early on I under-scoped a domain and had to redo the phase-plan section after a supervisor review. That taught me to question my own assumptions before presenting a finding as final.

I came in expecting to prefer offensive security, and I did enjoy it, but the compliance side pulled at me more. It’s where the technical and the legal and policy questions meet, which is part of why I’m still weighing law school. Between deployment, compliance research, and teaching Cyber Academy, this internship showed me I want a career that doesn’t force a choice between the technical and the policy side of security.