Remote opportunity at
1PasswordSecurity Intern, Threat Operations - Winter 2027
1Password is hiring a Security Intern for its Threat Operations team for a four-month term running from January to April 2027. This remote role operates within…
Career Tools
About This Role
1Password is hiring a Security Intern for its Threat Operations team for a four-month term running from January to April 2027. This remote role operates within Canada and the United States. 1Password develops enterprise password management and Unified Access Management solutions, serving over 180,000 businesses globally with a focus on blending productivity with security. The Threat Operations department combines Cyber Threat Intelligence, Detection Engineering, and Security Incident Response. In this…
Job Description
1Password is hiring a Security Intern for its Threat Operations team for a four-month term running from January to April 2027. This remote role operates within Canada and the United States. 1Password develops enterprise password management and Unified Access Management solutions, serving over 180,000 businesses globally with a focus on blending productivity with security.
The Threat Operations department combines Cyber Threat Intelligence, Detection Engineering, and Security Incident Response. In this internship, participants will work across all three specialized teams based on their personal interests and departmental needs, gaining hands-on experience in turning threat intelligence into functional defense mechanisms. The position involves a fast-paced and demanding environment where adaptability, curiosity, teamwork, and a willingness to embrace new challenges are essential.
Responsibilities
- Analyze incoming threat intelligence to determine credibility and relevance to 1Password infrastructure
- Execute indicator of compromise sweeps across the organizational environment
- Manage segments of the threat management lifecycle to generate recommendations for detection, vulnerability management, and incident response
- Participate in alert triage rotations to understand signal quality, enrichment, and response workflows
- Create and test detection rules and response agents for detection-as-code and response-as-code platforms
- Construct orchestration workflows with AI tool assistance to automate triage, enrichment, and response tasks
Requirements
- Demonstrated confidence and willingness to tackle new challenges through to completion
- Humility and readiness to ask questions and learn from mistakes
- Curiosity to find better operational approaches
- Strong teamwork and collaboration abilities
Qualifications
- Familiarity with Git and infrastructure or detections as code, including Terraform
- Scripting or programming proficiency in languages such as Python or Go, alongside API familiarity
- Exposure to SIEM tools, SOAR tools, log analysis, or writing detection rules and queries through projects, coursework, or labs
- Experience using AI tools for workflow building or automation
- Familiarity with frameworks like MITRE ATT&CK, security clubs, CTFs, or security coursework
Core Skills
Benefits
- Generous PTO policy providing 2.08 days per month
- Company-wide wellness days occurring once per quarter
- Access to employee-led inclusion and belonging programs and employee resource groups
- Participation in peer-to-peer recognition through Bonusly
- Access to 1Password University and learning sessions
- Monthly internship events and social gatherings
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, this is a remote opportunity available within Canada and the United States.
What are the dates for this internship?
The internship runs for four months from January to April 2027.
What is the salary for this role?
The salary is not stated in the job posting.
What teams will the intern work with?
Interns work across three teams within Threat Operations: Cyber Threat Intelligence, Detection Engineering, and Security Incident Response.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
