Detection & Response Security Engineer, Intern (Summer 2027)

Meta•New York, NY

20d•$7,313 - $11,293

About The Position

Meta Security is hiring a Detection & Response Security Engineer Intern for Summer 2027. The intern will collaborate with Security Analysts, Software Engineers, and Offensive Security Engineers to identify critical assets, assess risks, and evaluate and detect potential internal and external attacks against Meta systems. The work spans engineering teams supporting Production and Corporate systems and includes developing detection and response automation using industry-standard and custom platforms. The intern will generate and implement detection ideas using large datasets and hyperscale data pipelines. Potential teams include Surface Coverage – Detection Engineering and Insider Trust – Detection Engineering.

Requirements

Be in the process of obtaining a BS or MS in Computer Science or a related field.
Experience analyzing network and host-based security events.
Knowledge of networking technologies, specifically TCP/IP and related protocols.
Knowledge of operating systems, file systems, and memory structures on Windows, macOS, and Linux.
Coding or scripting experience in one or more general-purpose languages.
Experience with attacker tactics, techniques, and procedures.
Obtain work authorization in the country of employment by the time of hire and maintain ongoing work authorization during employment.

Nice To Haves

Experience in Detection & Response Engineering or a similar Security Engineering role.
Experience designing systems used to respond to external and/or insider threats.
Experience building automations and integrations using SOIR platforms.
Background in security-focused software engineering, large-scale system and data-pipeline design, or offensive security.
Experience in threat hunting, including using intelligence data to proactively identify and iteratively investigate suspicious behavior across networks and systems.
Experience with anomaly detection applicable to insider threat detection.
Familiarity with campaign-tracking techniques and converting tracking results into long-term countermeasures.
Familiarity with threat-modeling frameworks such as the Diamond Model and/or MITRE ATT&CK.
Experience with intelligence-driven threat hunting to identify suspicious activity and potential risks, and with building notebooks to automate hunts.
Broad knowledge across the security domain and deep focus in one or more areas such as log and event processing, incident management, digital forensics, offensive security testing, or detection and/or response tooling development.
Intent to return to a full-time degree program after completing the internship.

Responsibilities

Work on cross-functional projects to improve the ability to detect and respond to security incidents.
Review the security architecture of large-scale custom and commercial systems and independently propose logging, detection, and prevention controls.
Perform TTP-based threat modeling for assets including endpoints, mobile devices, servers, internal services, public and private cloud environments, and networking equipment.
Analyze logs from a variety of sources, such as host and network traffic logs, to identify potential threats and detection ideas.
Build response workflows and actions that automatically resolve false positives and provide context to scale investigations.
Support security incident response in a cross-functional environment and drive resolution of internal and external threats.
Design and implement attack-testing automation to validate detection coverage.
Build logging pipelines using Meta’s custom datasets and infrastructure.
Track threat clusters that pose threats to Meta’s infrastructure and employees.
Improve threat-cluster tracking tools and integrate intelligence data into existing systems and intelligence feeds.