Assist with vulnerability management by reviewing scan results, helping validate findings, and tracking remediation with system owners.
Help tune detections and reduce alert noise by identifying recurring false-positive patterns and proposing rule adjustments.
Review threat intelligence and vendor advisories, summarize what is relevant to Filevine, and help map observed activity to the MITRE ATT&CK framework.
Support incident response activities as directed, including evidence collection, timeline building, and note-taking during active incidents.
Create and improve SOC documentation: runbooks, playbooks, knowledge base articles, and onboarding guides.
- Complete a capstone project (for example, building a new detection, automating a triage step with a script, or improving a playbook) and present the results to the Security team at the end of the internship.
- What You Will Learn
- How an enterprise SOC operates day to day: the alert lifecycle, escalation paths, incident handling (aligned to NIST SP 800-61), and the metrics used to measure a SOC.
Hands-on use of production security tooling, including a SIEM, EDR, email security, identity and access management, and cloud security platforms.
Practical investigation skills: log analysis, phishing analysis, basic malware triage, and writing clear, defensible investigation notes.
How security operations supports compliance obligations (for example, SOC 2 and customer security requirements) in a legal technology company that handles sensitive client data.
Professional skills: working a queue, communicating with engineers and non-technical stakeholders, and receiving structured feedback from a dedicated mentor. Qualifications Pursuing a career in cybersecurity or a related technical field through a degree program, certification track, bootcamp, or self-study. Formal enrollment is not required; demonstrable experience (a documented home lab, CTF results, open-source contributions, or prior IT, help desk, compliance or system administration work) is equally welcome.
Working knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, common ports and protocols), operating systems, and introductory security concepts, gained through coursework, certifications, or hands-on experience.
Foundational understanding of common attack techniques (phishing, malware, credential abuse, privilege escalation, lateral movement) and the defensive controls that counter them.
Hands-on exposure to security tools through coursework, labs, competitions, a home lab, or prior work, such as Wireshark, Nmap, a SIEM (Splunk, Elastic, Microsoft Sentinel, or similar), or Security Onion.
Strong written and verbal communication skills, including the ability to document technical findings clearly and concisely for both technical and non-technical readers.
Curiosity, attention to detail, sound judgment, and a willingness to ask questions and learn from feedback.
Demonstrated integrity and the ability to handle confidential information with discretion.
- Able to commit to the stated weekly schedule for the duration of the internship.
- Preferred Qualifications
- Progress toward a security or IT certification such as CompTIA Security+, Network+, CySA+, or GIAC GFACT / GSEC — started, in progress, or planned.
Any self-directed security learning: Capture the Flag (CTF) events, collegiate competitions (for example, CCDC or National Cyber League), a campus security club, a home lab, online labs such as TryHackMe or Hack The Box, or a security-focused course sequence.
Awareness of common security frameworks — MITRE ATT&CK, the NIST Cybersecurity Framework, or NIST SP 800-61 incident handling guidance. Classroom-level familiarity is enough; we will teach the rest.
Any exposure to cloud platforms (AWS, Azure, or GCP) or identity providers (Okta, Microsoft Entra ID, or similar), including coursework, a free-tier account, or administering accounts in a prior job.
Comfort with ticketing, tracking, or documentation tools such as Jira, Confluence, ServiceNow, or a GRC/audit platform.
Background in compliance, audit, risk, privacy, or a similar control-oriented role — including SOC 2, ISO 27001, or HIPAA work — and an interest in moving toward the technical side of security.
- Genuine enthusiasm for the field — following security news, podcasts, or write-ups, and able to talk about a breach or technique that caught your interest.
- Internship Perks
- Paid internship with competitive hourly compensation
Dedicated mentor and structured learning plan for the duration of the internship
Real production experience and a capstone project to showcase in future interviews
Potential pathway to a full-time Jr. Security Specialist – Tier 1 role for high performers
Open office working atmosphere
Laptop provided for the duration of the internship
