Cybersecurity Operations & Incident Response Intern

About the role

Key responsibilities

• Monitor SIEM/security monitoring alerts, perform initial triage, and investigate endpoint, network, identity, and cloud telemetry.
• Search and correlate security data; document evidence, severity, impact, findings, and recommended actions.
• Assist with incident response activities, detection rule creation and tuning, threat hunting, forensic investigation, and cloud/identity event analysis.
• Contribute to timelines, reports, shift handovers, and executive summaries; participate in purple-team and simulated incident exercises.
• Help improve detection coverage, reduce false positives, strengthen monitoring, and maintain investigation documentation and procedures.

Tools and technologies

• SIEM tools include Splunk, Elastic Stack/Kibana, and Microsoft Sentinel.
• Endpoint/network tools include Sysmon, Windows Event Logs, Zeek, Suricata, and Wireshark; detection includes Sigma, MITRE ATT&CK, and ATT&CK Navigator.
• Forensics tools include Velociraptor, Volatility 3, KAPE, Plaso, and Timesketch; threat intelligence includes MISP and STIX/TAXII.
• Incident management tools include TheHive and Cortex; automation includes Shuffle/SOAR technologies.
• Cloud and identity technologies include AWS CloudTrail and Microsoft Entra ID; security testing includes Atomic Red Team.

Learning outcomes

• Learn how SOC events progress from event to alert, investigation, incident, and resolution; analyze and correlate logs from multiple sources.
• Conduct structured evidence-based alert investigations and write clear investigation notes.
• Apply MITRE ATT&CK, develop and tune basic detection rules, and understand the NIST incident response lifecycle.
• Support incident containment and investigation activities; the supplied description cuts off during a further learning outcome.