Security Specialist, Intern

Filevine•Salt Lake City, UT

13d•Hybrid

About The Position

Filevine is seeking a Security Specialist Intern to join its Information Security team. This paid, mentored internship is intended for early-career candidates building toward a cybersecurity career through academic study, certifications, or demonstrable self-directed experience. Interns contribute to the team while receiving coaching, ticket review, and career guidance from an experienced analyst. Working alongside Security Specialists, the intern will help monitor a modern cloud-based software environment, triage security alerts, investigate suspicious activity, and improve the documentation and automation that support the Security Operations Center (SOC). The internship provides practical experience across the alert lifecycle and includes a capstone project to present to the Security team. The position is based out of Filevine’s Salt Lake City, Chicago, or San Francisco offices. Candidates living in or near these metro areas are expected to work hybrid, 2–3 days per week in the office, or fully onsite. A laptop is provided for the duration of the internship.

Requirements

Pursuing a career in cybersecurity or a related technical field through a degree program, certification track, bootcamp, or self-study; formal enrollment is not required.
Demonstrable experience may include a documented home lab, CTF results, open-source contributions, or prior IT, help desk, compliance, or system administration work.
Working knowledge of networking fundamentals, including TCP/IP, DNS, HTTP/S, common ports and protocols, operating systems, and introductory security concepts, acquired through coursework, certifications, or hands-on experience.
Foundational understanding of common attack techniques, including phishing, malware, credential abuse, privilege escalation, and lateral movement, and the defensive controls used against them.
Hands-on exposure to security tools through coursework, labs, competitions, a home lab, or prior work; examples include Wireshark, Nmap, a SIEM such as Splunk, Elastic, or Microsoft Sentinel, or Security Onion.
Strong written and verbal communication skills, including the ability to document technical findings clearly and concisely for technical and non-technical readers.
Curiosity, attention to detail, sound judgment, and willingness to ask questions and learn from feedback.
Demonstrated integrity and ability to handle confidential information with discretion.
Ability to commit to the stated weekly schedule for the duration of the internship.

Nice To Haves

Progress toward a security or IT certification such as CompTIA Security+, Network+, CySA+, or GIAC GFACT/GSEC; certification may be started, in progress, or planned.
Self-directed security learning, such as CTF events, collegiate competitions including CCDC or National Cyber League, a campus security club, a home lab, TryHackMe, Hack The Box, or a security-focused course sequence.
Awareness of MITRE ATT&CK, the NIST Cybersecurity Framework, or NIST SP 800-61 incident-handling guidance; classroom-level familiarity is sufficient.
Exposure to cloud platforms such as AWS, Azure, or GCP, or identity providers such as Okta or Microsoft Entra ID, through coursework, a free-tier account, or prior work.
Comfort with ticketing, tracking, or documentation tools such as Jira, Confluence, ServiceNow, or a GRC/audit platform.
Background in compliance, audit, risk, privacy, or a similar control-oriented role, including SOC 2, ISO 27001, or HIPAA work, with an interest in moving toward technical security.
Genuine enthusiasm for cybersecurity, including following security news, podcasts, or write-ups and being able to discuss a breach or technique of interest.

Responsibilities

Monitor security alerts and events in SIEM, endpoint detection and response (EDR), email security, and cloud security tools under the guidance of Security Specialists.
Perform initial Tier 1 alert triage by gathering context, assessing whether alerts are true positives, false positives, or benign, documenting findings, and escalating according to SOC runbooks.
Manage SOC tickets, keeping them accurate and up to date, tracking investigations to closure, and communicating status to the team.
Investigate employee-reported phishing emails by analyzing headers, links, and attachments in a sandbox, helping block malicious indicators, and assisting with user notifications.
Assist with vulnerability management by reviewing scan results, helping validate findings, and tracking remediation with system owners.
Help tune detections and reduce alert noise by identifying recurring false-positive patterns and proposing rule adjustments.
Review threat intelligence and vendor advisories, summarize relevant information for Filevine, and help map observed activity to the MITRE ATT&CK framework.
Support incident response as directed, including evidence collection, timeline building, and note-taking during active incidents.
Create and improve SOC documentation, including runbooks, playbooks, knowledge base articles, and onboarding guides.
Complete a capstone project, such as building a detection, automating a triage step with a script, or improving a playbook, and present the results to the Security team at the end of the internship.

Benefits

Paid internship with competitive hourly compensation.
Dedicated mentor and structured learning plan for the duration of the internship.
Real production experience and a capstone project to showcase in future interviews.
Potential pathway to a full-time Jr. Security Specialist – Tier 1 role for high performers.
Open office working atmosphere.
Laptop provided for the duration of the internship.
Medical, dental, and vision insurance for full-time employees.
Competitive and fair pay.
Maternity and paternity leave for full-time employees.
Short- and long-term disability.
Opportunity to learn from a dedicated leadership team.
Company swag.