Detection & Response Security Engineer, Intern (Summer 2027)

What you'll do

• Improve detection and response capabilities, review system security architecture, and propose logging, detection, and prevention controls.
• Analyze security logs and perform TTP-based threat modeling, threat hunting, and incident response across Meta systems.
• Build response workflows, attack-testing automation, logging pipelines, and tools for tracking threat clusters and integrating intelligence data.

What they ask for

• Be pursuing a BS or MS in Computer Science or a related field and intend to return to a full-time degree program after the internship.
• Have experience analyzing network and host-based security events; know TCP/IP and related protocols, and Windows, MacOS, and Linux operating systems, file systems, and memory structures.
• Have coding or scripting experience in one or more general-purpose languages and experience with attacker tactics, techniques, and procedures.
• Obtain and maintain work authorization in the country of employment during employment.

Nice to have

• Experience in Detection & Response Engineering or similar Security Engineering; designing threat-response systems; building automations and integrations using SOIR platforms; or security-focused software engineering, large-scale systems and data pipelines, or offensive security.
• Experience or familiarity with threat hunting, anomaly detection, campaign tracking, threat modeling frameworks such as Diamond Model or MITRE ATT&CK, or intelligence-driven hunts and notebooks.

Pay

$7,313/month to $11,293/month (base salary)

Tools

TCP/IP, Windows, MacOS, Linux, SOIR platforms, Diamond Model, MITRE ATT&CK