About the role#
Threat Operations is part of the 1Password security organization. The team combines Cyber Threat Intelligence, Detection Engineering, and Security Incident Response. As an intern, you will work across these three areas to see how intelligence turns into real defense. You will focus on tasks shaped by both your interests and the needs of the team. This is a 4-month remote internship running from January to April 2027.
What you'll do#
- Analyze incoming threat intelligence to assess credibility and relevance.
- Run IOC sweeps across the environment.
- Manage tasks across the threat management lifecycle, from initial intel to final recommendations.
- Participate in the alert triage rotation to understand signal quality and enrichment.
- Develop and test detection rules and response agents.
- Contribute to detection-as-code and response-as-code platforms.
- Build orchestration workflows to automate triage and response, including the use of AI tools.
What you'll need#
- Confidence to take on new challenges and see them through to completion.
- Humility and a willingness to ask questions or acknowledge mistakes.
- Curiosity and a drive to find better ways of doing things.
- Strong teamwork and collaboration skills.
- Bonus: Familiarity with Git, infrastructure or detections as code, and Terraform.
- Bonus: Scripting or programming experience in Python or Go, and comfort working with APIs.
- Bonus: Exposure to SIEM and SOAR tools, logs, or writing detection rules.
- Bonus: Experience using AI tools to build or automate workflows.
- Bonus: Familiarity with frameworks like MITRE ATT&CK, plus participation in security coursework, CTFs, home labs, or security clubs.
Location & details#
- This role is fully remote within the United States or Canada.
- This is a full-time, paid internship.
- Term: Winter 2027 (January to April).
About 1Password
1Password operates in the computer and network security industry. Founded in 2005, the company provides tools for managing passwords and sensitive business information. It serves over 180,000 businesses as part of their identity and access management stack. The firm is based in Toronto and maintains a staff of 1,001 to 5,000 employees.
How to get in at 1Password
Securing an internship at 1Password requires speed, as early applicants are often reviewed before a large volume of candidates builds up. Intern Insider sends an instant alert the moment a role matching your target is published, which helps you apply among the first. This timing often makes a difference in whether your resume reaches a human reader. You can use this advantage to stay ahead of the typical application surge. Beyond timing, reaching out to recruiters directly often improves your response rate compared to applying through a general queue. Intern Insider surfaces the specific recruiters behind 1Password roles, allowing you to ask relevant questions or request a referral. Connecting with the right person shows genuine interest and helps you stand out from the pile.
