1Password
Security Intern, Threat Operations - Winter 2027
Remote (United States +1 · Remote · Internship · Posted Oct 22, 2026
- Location
- Remote (United States
Canada) - Experience
- No years of experience specified; internship is 4 months, January to April 2027.
About the job
Supports threat intelligence, detection engineering, and incident response by analyzing threats, building detections, and automating security workflows.
What you'll do
- Assess threat intelligence and credibility, run IOC sweeps, and turn findings into security recommendations.
- Participate in alert triage and develop and test detection rules and response agents.
- Build orchestration workflows to automate triage, enrichment, and response, using AI tools.
What they ask for
- Confidence taking on challenges and completing work.
- Humility, curiosity, and willingness to learn from mistakes and feedback.
- Teamwork and collaboration.
Nice to have
- Familiarity with Git, Terraform, Python or Go, APIs, SIEM/SOAR tools, logs, detection rules, or queries.
- Exposure to AI workflow automation, MITRE ATT&CK, security coursework, CTFs, home labs, or a security club.
Tools
Git, Terraform, Python, Go, SIEM, SOAR, MITRE ATT&CK
AI focus
Use AI tools to design and build automated security triage, enrichment, and response workflows; evaluate AI output critically.
Model-written summary · the original posting is authoritative