Security Specialist, Intern

Filevine•Salt Lake City, UT

14d•Hybrid

About The Position

Filevine is seeking a Security Specialist Intern to join its Information Security team. This is a paid, mentored internship for early-career candidates pursuing cybersecurity through an academic program, certification track, bootcamp, or self-directed hands-on experience. The intern will work alongside Security Specialists to help defend Filevine’s cloud-based software platform by monitoring the environment, triaging alerts, investigating suspicious activity, and improving SOC documentation and automation. Interns contribute to the team and are paired with an experienced analyst for coaching, ticket review, and career guidance. The internship provides practical experience across the security alert lifecycle, production security tooling, and SOC operations. The intern will complete a capstone project and present its results to the Security team. High performers may have a potential pathway to a full-time Jr. Security Specialist – Tier 1 role. The position is based out of Filevine’s Salt Lake City, Chicago, or San Francisco offices; candidates residing in or near these metro areas are expected to work hybrid, 2–3 days in office per week, or fully onsite.

Requirements

Pursuing a career in cybersecurity or a related technical field through a degree program, certification track, bootcamp, or self-study; formal enrollment is not required if the candidate has demonstrable experience.
Working knowledge of networking fundamentals, including TCP/IP, DNS, HTTP/S, common ports and protocols, operating systems, and introductory security concepts.
Foundational understanding of common attack techniques, including phishing, malware, credential abuse, privilege escalation, and lateral movement, and the defensive controls that counter them.
Hands-on exposure to security tools through coursework, labs, competitions, a home lab, or prior work; examples include Wireshark, Nmap, a SIEM such as Splunk, Elastic, or Microsoft Sentinel, or Security Onion.
Strong written and verbal communication skills, including the ability to document technical findings clearly and concisely for technical and non-technical readers.
Curiosity, attention to detail, sound judgment, and willingness to ask questions and learn from feedback.
Demonstrated integrity and ability to handle confidential information with discretion.
Ability to commit to the stated weekly schedule for the internship.

Nice To Haves

Progress toward a security or IT certification such as CompTIA Security+, Network+, CySA+, or GIAC GFACT/GSEC; certification may be started, in progress, or planned.
Self-directed security learning, such as CTF events, collegiate competitions, a campus security club, a home lab, online labs such as TryHackMe or Hack The Box, or a security-focused course sequence.
Awareness of security frameworks or guidance such as MITRE ATT&CK, the NIST Cybersecurity Framework, or NIST SP 800-61 incident handling guidance.
Exposure to cloud platforms such as AWS, Azure, or GCP, or identity providers such as Okta or Microsoft Entra ID, through coursework, a free-tier account, or prior work.
Comfort with ticketing, tracking, or documentation tools such as Jira, Confluence, ServiceNow, or a GRC/audit platform.
Background in compliance, audit, risk, privacy, or a similar control-oriented role, including SOC 2, ISO 27001, or HIPAA work, and interest in moving toward the technical side of security.
Genuine enthusiasm for cybersecurity, including following security news, podcasts, or write-ups and being able to discuss a breach or technique of interest.

Responsibilities

Monitor security alerts and events in SIEM, EDR, email security, and cloud security tools under the guidance of Security Specialists.
Perform initial Tier 1 alert triage by gathering context, determining whether alerts are true positives, false positives, or benign, documenting findings, and escalating according to SOC runbooks.
Work the SOC ticket queue, keep tickets accurate and current, track investigations through closure, and communicate status to the team.
Investigate employee-reported phishing emails by analyzing headers, links, and attachments in a sandbox, helping block malicious indicators, and assisting with user notifications.
Assist with vulnerability management by reviewing scan results, helping validate findings, and tracking remediation with system owners.
Help tune detections and reduce alert noise by identifying recurring false-positive patterns and proposing rule adjustments.
Review threat intelligence and vendor advisories, summarize relevant information for Filevine, and help map observed activity to the MITRE ATT&CK framework.
Support incident response as directed, including evidence collection, timeline building, and note-taking during active incidents.
Create and improve SOC documentation, including runbooks, playbooks, knowledge base articles, and onboarding guides.
Complete a capstone project, such as building a detection, automating a triage step with a script, or improving a playbook, and present the results to the Security team.
Work within the stated weekly schedule for the duration of the internship.

Benefits

Paid internship with competitive hourly compensation.
Dedicated mentor and structured learning plan for the duration of the internship.
Real production experience and a capstone project to showcase in future interviews.
Potential pathway to a full-time Jr. Security Specialist – Tier 1 role for high performers.
Open office working atmosphere.
Laptop provided for the duration of the internship.
Medical, dental, and vision insurance for full-time employees.
Maternity and paternity leave for full-time employees.
Short- and long-term disability.
Opportunity to learn from a dedicated leadership team.
Top-of-the-line company swag.
Competitive and fair pay.