Intern (Cyber Security)

Key Responsibilities

Requirements and Tool Evaluation

Translate agreed security-monitoring and incident-response use cases into functional, technical and operational requirements.

Research and compare open-source tools for security information and event management, log management, endpoint visibility, network detection, case management, threat intelligence and security orchestration.

Assess shortlisted tools for integration coverage, detection capability, scalability, performance, access control, deployment complexity, licensing, community health, release cadence and ongoing maintenance effort.

Document evaluation results using a consistent assessment matrix and recommend tools for controlled proof-of-concept testing.

Solution Design and Proof of Concept

Develop solution architecture, component, data-flow and integration diagrams for the proposed security-monitoring platform.

Deploy and configure approved tools in a segregated lab or proof-of-concept environment.

Implement secure authentication, role-based access, encryption, administrative logging, retention, backup and health-monitoring configurations.

Record configuration decisions, dependencies, assumptions, issues and risks so that the build can be reproduced and reviewed.

Data Source Integration

Integrate representative telemetry from Windows and Linux systems, endpoints, network devices, firewalls, cloud platforms, identity services, applications, SaaS platforms and existing security tools.

Configure and test collection, parsing, normalization, enrichment, indexing, retention, search and dashboard functions.

Validate that log sources are complete, time-synchronized, correctly classified and traceable to their originating systems.

Troubleshoot collection, connector, parsing and ingestion issues and document repeatable resolutions.

Detection Engineering and Validation

Develop and tune detection rules for agreed scenarios such as suspicious authentication, privileged-account misuse, endpoint compromise, unauthorized configuration changes, anomalous network activity and cloud-account misuse.

Map relevant detection rules and test scenarios to MITRE ATT&CK techniques where appropriate.

Generate approved test events or simulated activity and verify that telemetry is collected, correlated, enriched, alerted and displayed as designed.

Assess detection coverage, accuracy, completeness, timeliness, false-positive behavior and the investigative context presented to an eventual SOC or incident-response team.

Document test cases, expected results, actual results, defects and remediation recommendations.

Automation and Documentation

Develop basic Python, PowerShell or Bash scripts for log parsing, data transformation, alert enrichment, integration testing and validation reporting.

Create and maintain technical documentation, including architecture, installation, configuration, integration, administration, testing and troubleshooting guides.

Design and validate dashboards and reporting templates for operational and management use.

Present findings, implementation risks and recommendations to cybersecurity and technology stakeholders.

Expected Deliverables

A documented set of security-monitoring requirements, use cases and acceptance criteria.

A comparative assessment of shortlisted open-source technologies.

One or more securely configured and reproducible proofs of concept.

Validated integrations for agreed cloud, on-premises, endpoint, network, identity and SaaS data sources.

A baseline library of tested detection rules and corresponding validation results.

Architecture, build, administration, troubleshooting and handover documentation.

A final recommendation covering technical fit, limitations, operational effort, infrastructure requirements, risks and an implementation roadmap.

Required Qualifications

Currently pursuing or recently completed a degree or diploma in cybersecurity, computer science, information technology, electronics or a related discipline.

Good understanding of cybersecurity, networking, operating systems, system and application logs, authentication and incident-detection concepts.

Working familiarity with Linux and Windows environments and comfort using command-line tools.

Basic scripting ability in Python, PowerShell, Bash or a similar language.

Ability to install, configure, test and troubleshoot software in a lab environment.

Strong analytical, problem-solving, documentation and written communication skills.

Ability to learn unfamiliar technologies, test assumptions systematically and raise technical issues promptly.

Preferred Qualifications

Exposure to a cloud platform such as AWS, Microsoft Azure or Google Cloud.

Familiarity with common telemetry sources and formats, including Syslog, Windows Event Logs, JSON, API-based telemetry and cloud audit logs.

Exposure to SIEM, log-management, endpoint-monitoring, network-detection, SOAR or threat-intelligence concepts and tools.

Experience with Docker, virtual machines, APIs, Git or basic system administration.

Awareness of tools such as Wazuh, Security Onion, OpenSearch, Suricata, Zeek, osquery, Velociraptor, TheHive, MISP or comparable platforms.

Academic, personal, lab or project experience implementing or integrating an open-source security tool.

Prior production SOC experience is not required.

Success Measures

Quality, consistency and evidence base of tool evaluations and recommendations.

Security, reproducibility and reliability of proof-of-concept implementations.

Accuracy and completeness of data-source integrations and detection validation.

Identification and clear communication of technical, licensing, scalability and operational risks.

Quality of test evidence, technical documentation and implementation handover materials.

Compliance with confidentiality, data-handling, access-control and change-management requirements.