Security Specialist, Intern

Filevine is a Legal AI company delivering Legal Operating Intelligence for the future of legal work. Grounded in a singular system of truth, Filevine brings together data, documents, workflows, and teams into one unified platform—where modern legal work happens with clarity and consistency. Powered by LOIS , the Legal Operating Intelligence System, Filevine connects context across every matter to transform legal operations from reactive to proactive. LOIS reads, understands, and reasons across your data to surface insight, automate complexity, and give professionals the clarity and confidence to see more, know more, and do more. Fueled by a team of exceptional collaborators and innovators, Filevine’s rapid growth has earned AI awards and recognition from Deloitte and Inc. as one of the most innovative and fastest-growing technology companies in the country. Department Statement: The Information Security team is responsible to ensure the SOC efforts are effective and aligned with industry standards and best practices. Interns are treated as contributing members of the team and are paired with an experienced analyst for coaching, ticket review, and career guidance. Job Summary Filevine is looking for a Security Specialist – Intern to join our Information Security team. This is a paid, mentored internship for early-career candidates building toward a career in cybersecurity, whether through an academic program, a certification track, or self-directed, demonstrable hands-on experience, who want real-world experience defending a modern cloud-based software platform. Working alongside our Security Specialists, you will help monitor our environment, triage security alerts, investigate suspicious activity, and improve the documentation and automation that keep the SOC running. You will finish the internship with practical experience across the alert lifecycle, a completed capstone project, and a clear picture of what a career in security operations looks like. If you are curious, detail-oriented, and enjoy solving puzzles, we want to talk to you. Responsibilities Monitor security alerts and events in the SIEM, endpoint detection and response (EDR), email security, and cloud security tools under the guidance of Security Specialists. Perform initial (Tier 1) triage of alerts: gather context, determine whether an alert is a true positive, false positive, or benign, document findings, and escalate per SOC runbooks. Work the SOC ticket queue: keep tickets accurate and up to date, track investigations to closure, and communicate status clearly to the team. Investigate employee-reported phishing emails: analyze headers, links, and attachments in a sandbox, help block malicious indicators, and assist with user notifications. Assist with vulnerability management by reviewing scan results, helping validate findings, and tracking remediation with system owners. Help tune detections and reduce alert noise by identifying recurring false-positive patterns and proposing rule adjustments. Review threat intelligence and vendor advisories, summarize what is relevant to Filevine, and help map observed activity to the MITRE ATT&CK framework. Support incident response activities as directed, including evidence collection, timeline building, and note-taking during active incidents. Create and improve SOC documentation: runbooks, playbooks, knowledge base articles, and onboarding guides. Complete a capstone project (for example, building a new detection, automating a triage step with a script, or improving a playbook) and present the results to the Security team at the end of the internship. What You Will Learn How an enterprise SOC operates day to day: the alert lifecycle, escalation paths, incident handling (aligned to NIST SP 800-61), and the metrics used to measure a SOC. Hands-on use of production security tooling, including a SIEM, EDR, email security, identity and access management, and cloud security platforms. Practical investigation skills: log analysis, phishing analysis, basic malware triage, and writing clear, defensible investigation notes. How security operations supports compliance obligations (for example, SOC 2 and customer security requirements) in a legal technology company that handles sensitive client data. Professional skills: working a queue, communicating with engineers and non-technical stakeholders, and receiving structured feedback from a dedicated mentor. Qualifications Pursuing a career in cybersecurity or a related technical field through a degree program, certification track, bootcamp, or self-study. Formal enrollment is not required; demonstrable experience (a documented home lab, CTF results, open-source contributions, or prior IT, help desk, compliance or system administration work) is equally welcome. Working knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, common ports and protocols), operating systems, and introductory security concepts, gained through coursework, certifications, or hands-on experience. Foundational understanding of common attack techniques (phishing, malware, credential abuse, privilege escalation, lateral movement) and the defensive controls that counter them. Hands-on exposure to security tools through coursework, labs, competitions, a home lab, or prior work, such as Wireshark, Nmap, a SIEM (Splunk, Elastic, Microsoft Sentinel, or similar), or Security Onion. Strong written and verbal communication skills, including the ability to document technical findings clearly and concisely for both technical and non-technical readers. Curiosity, attention to detail, sound judgment, and a willingness to ask questions and learn from feedback. Demonstrated integrity and the ability to handle confidential information with discretion. Able to commit to the stated weekly schedule for the duration of the internship. Preferred Qualifications Progress toward a security or IT certification such as CompTIA Security+, Network+, CySA+, or GIAC GFACT / GSEC — started, in progress, or planned. Any self-directed security learning: Capture the Flag (CTF) events, collegiate competitions (for example, CCDC or National Cyber League), a campus security club, a home lab, online labs such as TryHackMe or Hack The Box, or a security-focused course sequence. Awareness of common security frameworks — MITRE ATT&CK, the NIST Cybersecurity Framework, or NIST SP 800-61 incident handling guidance. Classroom-level familiarity is enough; we will teach the rest. Any exposure to cloud platforms (AWS, Azure, or GCP) or identity providers (Okta, Microsoft Entra ID, or similar), including coursework, a free-tier account, or administering accounts in a prior job. Comfort with ticketing, tracking, or documentation tools such as Jira, Confluence, ServiceNow, or a GRC/audit platform. Background in compliance, audit, risk, privacy, or a similar control-oriented role — including SOC 2, ISO 27001, or HIPAA work — and an interest in moving toward the technical side of security. Genuine enthusiasm for the field — following security news, podcasts, or write-ups, and able to talk about a breach or technique that caught your interest. Internship Perks Paid internship with competitive hourly compensation Dedicated mentor and structured learning plan for the duration of the internship Real production experience and a capstone project to showcase in future interviews Potential pathway to a full-time Jr. Security Specialist – Tier 1 role for high performers Open office working atmosphere Laptop provided for the duration of the internship Work Location Expectation: This position is based out of our Salt Lake City, Chicago, or San Francisco offices. Candidates residing in or near these metro areas are expected to work on a hybrid (2-3 days in-office/week) or fully onsite basis. Cool Company Benefits: