Security Intern, Threat Operations

1Password

. Analyze incoming threat intelligence, assess credibility and relevance to 1Password, and run IOC sweeps across the environment .

Posted 10/22/2026internshipRemote • United States, CanadaEntry LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat intelligence analysis, detection engineering, and incident response, with a strong foundation in scripting and automation using AI tools. Familiarity with security frameworks and tools enhances the ability to contribute effectively to threat management and detection processes.

Highest-signal resume keywords

Threat Intelligence AnalysisDetection EngineeringIncident ResponseScripting Experience (Python, Go)Familiarity with Git and Terraform

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat IntelligenceDetection Rules DevelopmentIncident ResponseScripting (Python, Go)Automation WorkflowsDetection-as-CodeResponse-as-CodeIOC SweepsLog AnalysisWriting Detection Queries

Soft Skills

CuriosityTeamworkWillingness to LearnProblem-SolvingAttention to Detail

Tools & Technologies

SIEM ToolsSOAR ToolsAI ToolsGitTerraform

Industry Keywords

MITRE ATT&CKCyber Threat IntelligenceSecurity Incident ResponseVulnerability ManagementSecurity Coursework

Tech Stack

Tools & technologies

PythonTerraformGo

About the role

Key responsibilities & impact

Analyze incoming threat intelligence, assess credibility and relevance to 1Password, and run IOC sweeps across the environment
Own work across the threat management lifecycle and turn intelligence into recommendations for detection, incident response, and vulnerability management
Join the alert triage rotation and learn how signal quality, enrichment, and response fit together
Develop and test detection rules and response agents
Contribute to detection-as-code and response-as-code platforms
Build orchestration workflows to automate triage, enrichment, and response using AI tools
Work across Cyber Threat Intelligence, Detection Engineering, and Security Incident Response teams

Requirements

What you’ll need

Willingness to take on new challenges and see them through to completion
Willingness to ask questions and learn from mistakes
Curiosity and interest in improving processes
Teamwork
Legally authorized to work in the United States or Canada; no work authorization, relocation assistance, or visa sponsorship provided
Must be currently enrolled at an educational institution
Anticipated graduation date required
Familiarity with Git and managing infrastructure or detections as code, including Terraform
Scripting or programming experience, such as Python or Go, and comfort working with APIs
Exposure to SIEM and SOAR tools, logs, or writing detection rules and queries through coursework, labs, or projects
Experience using AI tools to build or automate workflows, with healthy skepticism about their output
Familiarity with MITRE ATT&CK, security coursework, CTFs, home labs, or a security club
Successful applicants must complete a background check

Benefits

Comp & perks

Generous PTO policy - 2.08 days per month (1.5 work weeks per 4 month term)
Company-wide wellness days (1 per quarter)
Employee-led inclusion and belonging programs and ERGs
Remote-first environment
Peer-to-peer recognition through Bonusly
1Password University access and learning sessions
Monthly internship events and socials
Travel for in-person engagement, including annual department-wide offsites, team meetings, and customer/industry events