Summer '27 Intern - Cyber Security

Welltower Careers•Frisco, TX

About The Position

The Cyber Security Intern joins Welltower's Security Analytics team and reports to the Senior Manager, Security Analytics. This hands-on analyst role supports alert triage, threat hunting, detection-gap analysis, and the development of investigation runbooks and documentation to strengthen incident response. Over a 10-week period, the intern works 20–30 hours per week alongside the Security Analytics team on live alerts and investigations, learning how analysts use telemetry to inform decisions and practicing application of the MITRE ATT&CK framework to real alerts and investigations. The internship includes a capstone project to identify a detection coverage gap, map it to the relevant MITRE ATT&CK tactic and technique, coordinate with data owners and the managed security service provider (MSSP) to obtain telemetry, build and test a detection, and write a response runbook. The intern presents the result to security leadership and relevant vendors.

Requirements

Currently pursuing a bachelor's or master's degree in Cybersecurity, Computer Science, Information Systems, or a related field.
Working understanding of authentication and access control, the attack lifecycle (MITRE ATT&CK or cyber kill chain), common malware and phishing techniques, and basic log analysis.
Familiarity with Windows and basic networking, including TCP/IP, DNS, HTTP, and common ports.
Clear written communication skills to turn evidence into concise, accurate write-ups.
Comfort asking questions and working with people outside the team, including data owners and vendors.
Motivated and proactive, with initiative and a willingness to investigate problems.
Coachable and self-directed, able to take feedback and act on it.
Follows through, takes ownership of work, and flags questions or mistakes early.
Curious and persistent, with sound judgment around sensitive data.

Nice To Haves

Familiarity with a query language such as KQL, SQL, SPL, or similar.
Python, PowerShell, or another scripting language.
Experience mapping findings or coverage gaps to MITRE ATT&CK techniques.
Familiarity with identity and email security concepts such as MFA, OAuth/token abuse, phishing analysis, and email headers.
Hands-on exposure to SIEM, EDR, cloud security tooling, or detection engineering through coursework, a home lab, or CTFs.
Basic familiarity with Microsoft Office 365, AWS, or Azure/Entra concepts.
Experience writing technical documentation or procedures, such as runbooks, lab write-ups, or class reports.

Responsibilities

Identify a detection coverage gap with the security team, map it to a relevant MITRE ATT&CK tactic and technique, coordinate with data owners and the MSSP to obtain telemetry, build and test a detection, write a response runbook, and present the result to security leadership and relevant vendors.
Assist with triaging live alerts from the SIEM, EDR, and MDR partner in the ticketing system, using established runbooks; gather evidence and draft verdicts and reasoning for analyst review.
Assist with guided threat hunts across endpoint, identity, email, and cloud telemetry, and document findings.
Identify and document detection coverage gaps and the expected telemetry.
Map detection gaps and findings to adversary techniques using MITRE ATT&CK.
Draft investigation runbooks describing how to recognize activity, what information to collect, how to scope an investigation, and when to escalate.
Document investigation findings and observations that can help strengthen security controls.
Collaborate with IT, the service desk, and other departments to investigate and resolve security issues.
Work alongside the managed security partner to understand how escalations and alerts flow between its team and Welltower's team.
Perform other duties as assigned.