Cyber & AI Security · Internship Role
SOC & THREAT HUNTING
Monitor alerts, investigate the suspicious ones, and hunt for threats nobody alerted on, using SIEM tools and AI assistants.
SKILLS YOU'LL WALK AWAY WITH
Log analysisSIEM queriesMITRE ATT&CKIncident triageDetection rules (Sigma)
PROOF-OF-WORK TASKS8 TASKS
Start at Beginner and work up. Every task produces something real you can show: a report, a tool, a guide or a demo. Publish it on LinkedIn or GitHub as your proof of work.
B
Beginner
LEVEL 01
- 01Complete 3 free investigation labs on LetsDefend, BTLO or CyberDefenders, and write a short write-up for each: the alert, the evidence, and your verdict.
- 02Analyse sample Windows Event Logs or Linux auth logs to find brute-force login patterns, and present your findings in a table.
- 03Map 5 common attacks (phishing, brute force, ransomware, credential dumping, data exfiltration) to MITRE ATT&CK techniques, and note which logs would show each.
I
Intermediate
LEVEL 02
- 01Set up a home SOC lab (Wazuh or Security Onion in a VM), generate test activity, and show the alerts it produced.
- 02Write 5 Sigma detection rules for techniques you choose, test them on sample logs, and explain the false-positive risk of each.
- 03Use an AI assistant to help triage 10 alerts. Compare its verdicts with yours and document where it was right, wrong or overconfident.
A
Advanced
LEVEL 03
- 01Run a hypothesis-driven threat hunt on a public dataset (a CyberDefenders case or Splunk's Boss of the SOC data): hypothesis, queries, findings, and new detections.
- 02Build an AI-assisted triage workflow that enriches an alert (IP reputation, ATT&CK mapping, similar past alerts) and drafts a ticket, with a human approval step.
HAND-PICKED FREE RESOURCES7 RESOURCES
FREE COURSE
TryHackMe SOC Level 1
A structured SOC analyst path. Many rooms are free.
VISIT RESOURCE
FREE COURSE
LetsDefend
Practise as a SOC analyst on realistic alerts.
VISIT RESOURCE
FREE COURSE
Blue Team Labs Online
Free defensive investigations and challenges.
VISIT RESOURCE
FREE COURSE
CyberDefenders
Free blue-team labs built from real incidents.
VISIT RESOURCE
FREE COURSE
Splunk Free Training
Free official courses on searching and analysing logs.
VISIT RESOURCE
CODE REPO
Sigma Rules
Thousands of open detection rules to learn from and write your own.
VISIT RESOURCE
ARTICLE GUIDE
MITRE ATT&CK
The common language every SOC uses to describe attacker behaviour.
VISIT RESOURCE