Security Intern, Threat Operations - Winter 2027

Threat Operations is part of 1Password's Security organization, bringing together Cyber Threat Intelligence, Detection Engineering, and Security Incident Response. Together we study how threat actors operate, turn that into high-quality detections, and respond quickly when something goes wrong. Interns work across all three teams, with time and focus shaped by your interests and our needs, so you see how intelligence becomes real defense. This is a remote opportunity within Canada/US. This position will be for 4 months - January to April 2027.

Responsibilities

Analyze incoming threat intelligence, assess its credibility and relevance to 1Password, and run IOC sweeps across our environment; Own pieces of work across the threat management lifecycle, turning intel into recommendations for detection, incident response, and vulnerability management; Join the alert triage rotation and learn how signal quality, enrichment, and response fit together; Develop and test detection rules and response agents, and contribute to our detection-as-code and response-as-code platforms; Build orchestration workflows to automate triage, enrichment, and response, using AI tools to help design and build them

Requirements

Confidence: a willingness to take on new challenges and see them through to completion; Humility: not afraid to ask questions and make mistakes (as long as you learn from them); Curiosity: looks for better ways of doing things, even if everyone seems happy with how they are; Teamwork: works together and succeeds as a team

Nice to have

Familiarity with Git and managing infrastructure or detections as code, including Terraform; Scripting or programming experience, such as Python or Go, and comfort working with APIs; Exposure to SIEM and SOAR tools, logs, or writing detection rules and queries, through coursework, labs, or projects; Experience using AI tools to build or automate workflows, with a healthy skepticism about their output; Familiarity with frameworks like MITRE ATT&CK, plus security coursework, CTFs, home labs, or a security club

Benefits

Generous PTO policy - 2.08 days per month (1.5 work weeks per 4 month term); Company-wide wellness days (1 per quarter); Employee-led inclusion and belonging programs and ERGs; Remote-first environment; Peer-to-peer recognition through Bonusly; 1Password University access and learning sessions; Monthly internship events and socials