Summer '27 Intern - Cyber Security

Welltower™ Inc. (NYSE:WELL)•Frisco, TX

20h

About The Position

The Cyber Security Intern joins Welltower's Security Analytics team and reports to the Senior Manager, Security Analytics. This hands-on analyst role supports alert triage, threat hunting, detection-gap analysis, incident-response documentation, and security-control improvements. Over a 10-week internship at 20–30 hours per week, the intern works with the Security Analytics team on live alerts and investigations and practices applying the MITRE ATT&CK framework to real alerts and investigations. The intern’s capstone project is to identify a detection-coverage gap, map it to the relevant MITRE ATT&CK tactic and technique, coordinate with data owners and the managed security service provider (MSSP) to obtain telemetry, build and test a detection, and write a response runbook. The intern presents the project outcome to security leadership and relevant vendors.

Requirements

Currently pursuing a Bachelor's or Master's degree in Cybersecurity, Computer Science, Information Systems, or a related field.
Working understanding of authentication and access control, the attack lifecycle (MITRE ATT&CK or cyber kill chain), common malware and phishing techniques, and basic log analysis.
Familiarity with Windows and basic networking, including TCP/IP, DNS, HTTP, and common ports.
Clear written communication skills, including the ability to turn evidence into concise, accurate write-ups.
Comfort communicating and asking questions when working with people outside the team, including data owners and vendors.
Motivated and proactive, with initiative and a willingness to investigate problems independently.
Coachable and self-directed; able to take feedback and act on it.
Follows through, takes ownership of work, and flags questions or mistakes early.
Curious and persistent, with sound judgment around sensitive data.

Nice To Haves

Experience with a query language such as KQL, SQL, or SPL.
Experience with Python, PowerShell, or another scripting language.
Experience mapping findings or coverage gaps to MITRE ATT&CK techniques.
Familiarity with identity and email security concepts, including MFA, OAuth/token abuse, phishing analysis, and email headers.
Hands-on exposure to SIEM, EDR, cloud security tooling, or detection engineering through coursework, a home lab, or a CTF.
Basic familiarity with Microsoft Office 365, AWS, or Azure/Entra concepts.
Experience writing technical documentation or procedures, such as runbooks, lab write-ups, or class reports.

Responsibilities

Complete a capstone project identifying a detection-coverage gap and mapping it to the relevant MITRE ATT&CK tactic and technique.
Work with data owners and the MSSP to obtain telemetry, build and test a detection, and write a response runbook; present the results to security leadership and relevant vendors.
Assist with triaging live alerts from SIEM, EDR, and the MDR partner in the ticketing system using established runbooks; gather evidence and draft verdicts and reasoning for analyst review.
Assist with guided threat hunts across endpoint, identity, email, and cloud telemetry, and document findings.
Identify and document detection gaps and the telemetry expected to address them.
Map detection gaps and findings to adversary techniques using MITRE ATT&CK.
Draft investigation runbooks describing how to recognize activity, what evidence to collect, how to scope an issue, and when to escalate.
Document investigation findings and observations that can help strengthen security controls.
Collaborate with IT, the service desk, and other departments to investigate and resolve security issues.
Work alongside the managed security partner to understand how alerts and escalations flow between its team and Welltower's team.
Perform other duties as assigned.