Security Intern, Threat Operations - Winter 2027

Threat Operations is part of 1Password’s Security organization, bringing together Cyber Threat Intelligence, Detection Engineering, and Security Incident Response. Together we study how threat actors operate, turn that into high-quality detections, and respond quickly when something goes wrong. Interns work across all three teams, with time and focus shaped by your interests and our needs, so you see how intelligence becomes real defense. We care about turning intelligence into action, and we value blameless learning and psychological safety.

What You Can Expect:

• Analyze incoming threat intelligence, assess its credibility and relevance to 1Password, and run IOC sweeps across our environment.
• Own pieces of work across the threat management lifecycle, turning intel into recommendations for detection, incident response, and vulnerability management.
• Join the alert triage rotation and learn how signal quality, enrichment, and response fit together.
• Develop and test detection rules and response agents, and contribute to our detection-as-code and response-as-code platforms.
• Build orchestration workflows to automate triage, enrichment, and response, using AI tools to help design and build them.

What we're looking for:

• Familiarity with Git and managing infrastructure or detections as code, including Terraform.
• Scripting or programming experience, such as Python or Go, and comfort working with APIs.
• Exposure to SIEM and SOAR tools, logs, or writing detection rules and queries, through coursework, labs, or projects.
• Experience using AI tools to build or automate workflows, with a healthy skepticism about their output.
• Familiarity with frameworks like MITRE ATT&CK, plus security coursework, CTFs, home labs, or a security club.

How we’re using AI today