Skip to content
Sign inCreate account

Internships

Global Resilience Operations Internship

Rotate through our NOC, SOC and Technical Assistance Center and learn how 24/7 operations really work.

Open roles on this program

3 open roles. Every listing shows its pay range.

You join the Global Resilience Operations teams that keep our clients' systems running around the clock. You rotate through network operations, security operations and technical assistance, help improve the runbooks and dashboards those teams rely on, and finish with a project you present to operations leadership.

Security operations

  • Alert triage: look at alerts from endpoint detection and response tools and decide whether a process is a harmless update or something malicious.

  • Threat intelligence: read reports on new ransomware and attack groups, and check whether their indicators of compromise have appeared in client environments.

  • Phishing analysis: examine reported emails, their headers and their attachments in a sandbox, and learn how malicious messages are removed across an organization.

Network and cloud operations

  • Connectivity: watch the health of the network links and circuits that connect hospitals and banks, and learn to read latency and jitter.

  • Cloud capacity: monitor AWS and Azure usage, spot systems that need to scale, and find resources that can be switched off.

  • Patching: help run the patch cycle and see how teams apply security updates without breaking critical applications.

Technical assistance and incidents

  • Service desk: work alongside the Technical Assistance Center and see how problems are triaged by their impact on the client.

  • Incident timeline: during a major outage, record each action and decision for the review afterwards.

  • Root cause analysis: once service is restored, work with engineers to find out why the failure happened and track the fixes.

Who should apply

Students working toward a degree in IT, computer science or a related field, with a strong interest in infrastructure and security. Each listing shows the location and the internship allowance.

A day on the track

A Tuesday in week six, in the Security Operations Center

By week six you are in your second rotation. You triage real alerts alongside an analyst, and you have started your automation project.

This is an illustrative day put together from how our operations centers work. It is not one person's account, and your shift pattern, location and tools will differ.

  1. 08:30

    Shift handover

    The overnight team in Manila briefs your shift in London: two open investigations, one client running a planned failover tonight, and a new phishing campaign aimed at health systems. Handovers are formal, written and read back, so nothing is lost between time zones.

  2. 09:00

    Alert triage with your analyst

    An endpoint tool reports a script launched from a spreadsheet on a hospital billing workstation. You pull the process tree and the network connections, and the analyst asks you to decide before they tell you: is it a macro the finance team uses every month, or something worse? You check the history and find it runs on the first working day of each month. You close it with a note explaining why.

  3. 10:15

    Phishing analysis

    A credit union employee reported an email that claims to be from their payroll provider. You read the headers, open the link in a sandbox, and find a fake sign-in page. The analyst shows you how the message is removed from every mailbox at the client and how the domain is blocked.

  4. 11:30

    Threat intelligence stand-up

    Fifteen minutes on what's new: indicators from this morning's campaign, and whether any have appeared in client environments. You present what you found in the phishing email, briefly.

  5. 12:30

    Lunch

    The operations floor never closes, so lunch is staggered. You eat with two interns from the Network Operations Center rotation, who explain why a circuit to a rural hospital has been flapping all morning.

  6. 13:30

    Your automation project

    Each intern improves something the team relies on. Yours: when an analyst checks a suspicious address, they look it up in four tools by hand. You are writing a small script that queries all four and posts one summary to the case. Today you add error handling for when one tool is down.

  7. 15:00

    Incident drill

    A tabletop exercise: a simulated ransomware outbreak at a county agency. Your job is the incident timeline, recording each decision and its time. Afterwards the incident commander walks through what went well and what the timeline shows was slow.

  8. 16:30

    Runbook review

    You found a step in the phishing runbook that no longer matches the tool's menus. You propose a fix, and a senior analyst approves it. Runbooks are how a team in another time zone does the same thing the same way at 3 a.m.

  9. 17:00

    Hand over to Sydney

    You add your open items to the handover note for the next shift. Your sponsor messages to say they've set up a visit to the Technical Assistance Center for your next rotation.

What we look for

Three things we assess

Every interviewer scores the same competencies and writes their feedback before seeing anyone else's. For this track they are:

Calm, structured thinking

When several things go wrong at once, you work out what matters most and say why. We look for people who gather facts before acting, and act once the facts are clear enough.

Technical curiosity

You want to know how networks, operating systems and attacks actually work. Coursework, a home lab, a capture-the-flag competition or a certification all count.

Clear communication

You can write a short, accurate update that someone in another time zone can act on, and explain a technical problem to a person who isn't technical.

Sample interview questions

What we might ask

These are examples like the ones we use, not the exact questions. Open each one to see what a strong answer covers.

Online exercise

Here are 200 lines of authentication logs. Which accounts look compromised, and what makes you think so?

What a strong answer covers:

  • Patterns rather than single events: many failed logins followed by a success, or a success from a new country minutes after one from the usual city.
  • Telling a password spray (one password tried against many accounts) from brute force (many passwords against one account).
  • Saying what you'd check next and what could make the activity harmless, such as a VPN.
A service's latency has doubled since 02:00. Using the graphs provided, what do you think changed?

What a strong answer covers:

  • Lining up the graphs by time and looking for what moved first: traffic, errors, CPU, a deployment marker.
  • Separating cause from symptom: high CPU may be the result of retries, not the reason for them.
  • Naming the evidence that would confirm your theory.
Explain what happens, step by step, when someone types a website address into a browser.

What a strong answer covers:

  • DNS lookup, a TCP connection, the TLS handshake, then the HTTP request and response.
  • Where things commonly go wrong at each step, and what you'd see if they did.
  • Depth where you are confident, and honesty where you aren't.

Team interview

An alert says a workstation is talking to a domain registered yesterday. Walk us through your investigation.

What a strong answer covers:

  • Gathering context: which process made the connection, which user was signed in, what else that host did around the same time.
  • Checking the domain against threat intelligence, and how many other hosts contacted it.
  • Knowing when to contain: isolating the host if the evidence points to compromise, even before you are certain.
  • Writing up what you found so the next shift can continue.
A hospital calls: clinicians can't open patient records. You are on the service desk. What do you do in the first ten minutes?

What a strong answer covers:

  • Treating it as urgent because patient care is affected, and saying so in the ticket's priority.
  • Quick scoping questions: everyone or some people, one building or all, since when.
  • Checking for a wider problem (monitoring, recent changes, other clients) before troubleshooting one machine.
  • Escalating early and telling the caller when they will hear back.
What's the difference between availability and durability, and why would a bank care about both?

What a strong answer covers:

  • Availability: can you use the system now. Durability: is the data still there and correct.
  • A bank can survive a short outage but not a lost transaction, so the two are designed and tested differently.
Tell us about something you built or broke in a home lab, at university or at work.

What a strong answer covers:

  • A specific setup and a specific problem.
  • How you diagnosed it, and what you learned that you still use.

How you work

Tell us about a time you had to follow a procedure you thought was wrong.

What a strong answer covers:

  • Following it while it applied, especially where safety or compliance was involved, and raising the problem through the right channel.
  • What happened to your suggestion.
How do you stay focused on routine work, such as reviewing alerts that are almost always harmless?

What a strong answer covers:

  • Honest habits that work for you.
  • The idea that routine work is worth automating, and that the rare real alert hides among the harmless ones.
Some rotations involve shifts outside normal office hours. What would help you do that well?

What a strong answer covers:

  • A practical, honest answer. Tell us about constraints you have; we'd rather plan around them than find out later.

Practice

Two puzzles to try

These are the kind of problems our operations teams talk through. Try them before opening the hint.

Puzzle · about 20 minutes

Six alerts at 3 a.m.

It's 03:10 in New York and you are on shift in Manila. Six alerts are waiting. Put them in the order you would handle them, and say what you would do first for each.

  1. A reporting server at a credit union is 85% full and filling by about 1% a day.
  2. On a hospital billing workstation, a word processor has started a command shell, which is now connecting to an unfamiliar domain.
  3. A health system's prior authorization service has returned errors for 30% of requests for the last 6 minutes.
  4. The security certificate for a county's public records portal expires in 9 days.
  5. One broker-dealer user account has had 400 failed sign-ins in 5 minutes, from many different addresses.
  6. Last night's backup failed for one non-production test environment.
Hint

Ask two questions of each alert: is harm happening right now, and how quickly does it get worse if nobody acts? Some alerts need one quick action before a longer investigation.

Worked solution

A sensible order: 2, 3, 5, 1, 4, 6.

  • 2 first, but briefly. A document starting a shell that reaches out to an unknown domain is a classic sign of a malicious macro, and ransomware spreads in minutes. Isolate the workstation from the network (one action in the endpoint tool), then open an incident. Containment takes seconds; the investigation can continue in parallel.
  • 3 straight after, as a live incident. Clinicians are failing to get approvals now, which delays care. Open a major incident, page the service's on-call engineer, check for recent changes, and update the client. In a real team, 2 and 3 would be split between two people at once; saying so is a good answer.
  • 5 next. Many failed sign-ins from many addresses against one account is an attack on that account. Check whether any attempt succeeded, make sure multi-factor authentication is enforced, and block or lock as the client's runbook allows. Most likely the defences are holding, but a success would move this to the top.
  • 1, then 4, then 6. At 1% a day the disk has about two weeks; raise a ticket for the client's team. The certificate has 9 days; schedule the renewal and confirm an owner. A failed backup of a test environment matters, but nothing is at risk tonight; rerun it and note it for the day shift.

Whatever order you choose, write down why. The handover note is how the next shift knows what was done and what wasn't.

Puzzle · about 15 minutes

How much downtime is left?

A client's banking service has an availability target of 99.9%, measured over a 30-day month. Availability is measured by requests: a period when 20% of requests fail counts as 20% of that time unavailable.

So far this month the service had one full outage of 18 minutes, and one 90-minute period in which 20% of requests failed.

  1. How many minutes of downtime does the target allow in the month?
  2. How much is left?
  3. The client wants to rehearse a failover this month, which usually causes 10 minutes of full downtime. What do you advise?
Hint

A 30-day month has 30 × 24 × 60 minutes. Turn the partial outage into equivalent minutes of full downtime.

Worked solution

1. 30 × 24 × 60 = 43,200 minutes. 0.1% of that is 43.2 minutes.

2. The full outage used 18 minutes. The partial one counts as 90 × 20% = 18 minutes. 43.2 − 18 − 18 = 7.2 minutes left.

3. A 10-minute rehearsal would take the month to 46 minutes of downtime, over the 43.2 allowed. Good options: move the rehearsal to next month; find a way to rehearse with less downtime, for example by failing over at the lowest-traffic hour or one component at a time; or, if the client decides the rehearsal matters more than the target this month, agree that in writing in advance. Testing failover is important; it should be a decision, not a surprise.

Practice case

Work through an incident

In the team interview you may be asked to talk through a situation like this one. We want to see how you set priorities, what you ask, and how you would explain it to the client.

Practice case · 45 minutes

A phishing email at a credit union

The client and every number in this case are fictional, made up for practice.

Background

We run security operations for a credit union with 40 branches. At 08:02 an employee reports an email that looks like a password-expiry notice. It came from a look-alike domain and links to a fake sign-in page. Our mail logs show it reached 47 employees between 07:48 and 07:51.

Exhibit 1 · What recipients did (from mail, proxy and phishing-page logs)
ActionEmployees
Received the email47
Opened it30
Clicked the link9
Typed a password into the fake page3
Reported it6
Exhibit 2 · Sign-in activity for the three accounts whose passwords were typed in
AccountRolePassword typedWhat happened next
1Teller08:0508:11 sign-in from an unfamiliar address abroad; multi-factor prompt denied by the user
2Loan officer08:0708:09 sign-in from the same address; multi-factor prompt approved by the user; 08:14 a mail rule created that forwards all mail to an outside address
3IT administrator08:20No sign-in seen yet

Your task

  1. It's 08:25. List the actions you would take, in order, and who does each.
  2. What else would you investigate before calling the incident contained?
  3. Draft the first update to the credit union's IT director: no more than five sentences.
One way to approach it

Act first on the highest risk.

  1. Account 3, the IT administrator, is the most dangerous: an attacker with admin rights could disable defences or reach every system. Reset the password, end all sessions and check multi-factor settings now, before any sign-in happens.
  2. Account 2, the loan officer, is confirmed compromised. End all sessions, reset the password, remove the forwarding rule and block forwarding to outside addresses. Find out which messages were forwarded between 08:14 and now, because loan files contain members' personal and financial data.
  3. Account 1: the attacker has the password even though multi-factor stopped them. Reset it.
  4. Remove the email from all 47 mailboxes, block the sender's domain and the link, and add them to threat intelligence.
  5. Check the other 6 who clicked but, according to the page logs, didn't type a password. Confirm with them and check their sign-ins.

Before calling it contained: did account 2 do anything else, such as access shared files or send emails from inside the credit union? Were any devices infected through the link? Was account 2's approval of the prompt a mistake, or a sign of push fatigue, which suggests stronger multi-factor methods? Keep a timeline, and preserve logs for the client's records.

Regulatory clock: member data may have left the organization through the forwarding rule. Federally insured credit unions in the US must report certain cyber incidents to the NCUA within 72 hours, so the client's compliance team needs the facts early to make that call. It's their decision, but our timeline is their evidence.

A first update: "At 08:02 an employee reported a phishing email that reached 47 staff; three entered their passwords. One account (a loan officer) was accessed by the attacker at 08:09 and set to forward mail outside the credit union; we have stopped the forwarding, reset all three accounts, and removed the email from every mailbox. We are now establishing which messages were forwarded and whether member data was included. We recommend your compliance team is told now in case this becomes reportable. Next update by 10:00."

Also worth noticing: only 6 of 47 recipients (about 13%) reported the email. That's a useful number for the client's awareness training.

Next steps

Prepare, then apply

The first step is a short online exercise, followed by interviews with the team you would join. Every listing shows the location and the pay.