Security Specialist, Intern ›

Responsibilities

• Monitor security alerts and events in the SIEM, endpoint detection and response (EDR), email security, and cloud security tools under the guidance of Security Specialists.
• Perform initial (Tier 1) triage of alerts: gather context, determine whether an alert is a true positive, false positive, or benign, document findings, and escalate per SOC runbooks.
• Work the SOC ticket queue: keep tickets accurate and up to date, track investigations to closure, and communicate status clearly to the team.
• Investigate employee-reported phishing emails: analyze headers, links, and attachments in a sandbox, help block malicious indicators, and assist with user notifications.
• Assist with vulnerability management by reviewing scan results, helping validate findings, and tracking remediation with system owners.
• Help tune detections and reduce alert noise by identifying recurring false-positive patterns and proposing rule adjustments.
• Review threat intelligence and vendor advisories, summarize what is relevant to Filevine, and help map observed activity to the MITRE ATT&CK framework.
• Support incident response activities as directed, including evidence collection, timeline building, and note-taking during active incidents.
• Create and improve SOC documentation: runbooks, playbooks, knowledge base articles, and onboarding guides.
• Complete a capstone project (for example, building a new detection, automating a triage step with a script, or improving a playbook) and present the results to the Security team at the end of the internship.

What You Will Learn

• How an enterprise SOC operates day to day: the alert lifecycle, escalation paths, incident handling (aligned to NIST SP 800-61), and the metrics used to measure a SOC.
• Hands-on use of production security tooling, including a SIEM, EDR, email security, identity and access management, and cloud security platforms.
• Practical investigation skills: log analysis, phishing analysis, basic malware triage, and writing clear, defensible investigation notes.
• How security operations supports compliance obligations (for example, SOC 2 and customer security requirements) in a legal technology company that handles sensitive client data.
• Professional skills: working a queue, communicating with engineers and non-technical stakeholders, and receiving structured feedback from a dedicated mentor.

Qualifications

• Pursuing a career in cybersecurity or a related technical field through a degree program, certification track, bootcamp, or self-study. Formal enrollment is not required; demonstrable experience (a documented home lab, CTF results, open-source contributions, or prior IT, help desk, compliance or system administration work) is equally welcome.
• Working knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, common ports and protocols), operating systems, and introductory security concepts, gained through coursework, certifications, or hands-on experience.
• Foundational understanding of common attack techniques (phishing, malware, credential abuse, privilege escalation, lateral movement) and the defensive controls that counter them.
• Hands-on exposure to security tools through coursework, labs, competitions, a home lab, or prior work, such as Wireshark, Nmap, a SIEM (Splunk, Elastic, Microsoft Sentinel, or similar), or Security Onion.
• Strong written and verbal communication skills, including the ability to document technical findings clearly and concisely for both technical and non-technical readers.
• Curiosity, attention to detail, sound judgment, and a willingness to ask questions and learn from feedback.
• Demonstrated integrity and the ability to handle confidential information with discretion.
• Able to commit to the stated weekly schedule for the duration of the internship.

Preferred Qualifications

• Progress toward a security or IT certification such as CompTIA Security+, Network+, CySA+, or GIAC GFACT / GSEC — started, in progress, or planned.
• Any self-directed security learning: Capture the Flag (CTF) events, collegiate competitions (for example, CCDC or National Cyber League), a campus security club, a home lab, online labs such as TryHackMe or Hack The Box, or a security-focused course sequence.
• Awareness of common security frameworks — MITRE ATT&CK, the NIST Cybersecurity Framework, or NIST SP 800-61 incident handling guidance. Classroom-level familiarity is enough; we will teach the rest.
• Any exposure to cloud platforms (AWS, Azure, or GCP) or identity providers (Okta, Microsoft Entra ID, or similar), including coursework, a free-tier account, or administering accounts in a prior job.
• Comfort with ticketing, tracking, or documentation tools such as Jira, Confluence, ServiceNow, or a GRC/audit platform.
• Background in compliance, audit, risk, privacy, or a similar control-oriented role — including SOC 2, ISO 27001, or HIPAA work — and an interest in moving toward the technical side of security.
• Genuine enthusiasm for the field — following security news, podcasts, or write-ups, and able to talk about a breach or technique that caught your interest.

Internship Perks

• Paid internship with competitive hourly compensation
• Dedicated mentor and structured learning plan for the duration of the internship
• Real production experience and a capstone project to showcase in future interviews
• Potential pathway to a full-time Jr. Security Specialist – Tier 1 role for high performers
• Open office working atmosphere
• Laptop provided for the duration of the internship