Summer '27 Intern - Cyber Security

Welltower Careers; Frisco (TX); On-site; USD 25,000 - 36,000; Part time

Job summary

WELLTOWER is seeking a Cyber Security Intern to join the Security Analytics team in Frisco for a 10-week program at 20-30 hours per week. You’ll triage live alerts, assist with threat hunting, and help surface detection gaps while learning MITRE ATT&CK mappings and incident response practices.

You’ll work directly with IT, MSSP partners, and security leadership on a capstone project, build runbooks, and contribute to improving detection coverage.

Qualifications

• Currently pursuing a Bachelor's or Master's in Cybersecurity, Computer Science, Information Systems, or a related field.
• Working understanding of core security concepts: authentication and access control, the attack lifecycle (MITRE ATT&CK or cyber kill chain).
• Familiarity with Windows and basic networking (TCP/IP, DNS, HTTP).
• Clear written communication and collaborative skills.
• Motivated, proactive and able to work with data owners, vendors, and teams.

Responsibilities

• Assist with triage: handle live alerts from SIEM/EDR/MDR using runbooks and draft verdicts for review.
• Assist with threat hunting: run guided hunts across endpoint, identity, email and cloud telemetry.
• Help surface detection gaps: document coverage gaps and telemetry requirements.
• Apply MITRE ATT&CK: map findings to adversary techniques to guide coverage.
• Build investigation runbooks: outline recognition, data to pull, scoping, and escalation.
• Collaborate across teams: work with IT and service desk to resolve issues.
• Learn MSSP partnership workflows and incident escalation processes.

Skills

Cybersecurity basics

MITRE ATT&CK

Log analysis

Windows OS

Networking

KQL

Python

PowerShell

MITRE ATT&CK mapping

Education

Bachelor's or Master's in Cybersecurity/ CS

Job description

If you are a job seeker with a disability and require a reasonable accommodation to apply for one of our jobs, you will find the contact information to request the appropriate accommodation by visiting the following our Accessibility Accomodation for Applicants page.

Summer '27 Intern - Cyber Security

• Posted on November 5, 2026

Locations

Showing 1 location

Frisco, TX 75034, USA

• On-site
• Part-Time
• Requisition #: SUMME003548

Description

WELLTOWER – REIMAGINE REAL ESTATE WITH US

Welltower, now the world’s largest real estate company by market capitalization, is growing at an exciting pace! We’re transforming how the world thinks about senior living and wellness-focused real estate by making data-driven decisions—creating vibrant, purpose-driven communities where housing, healthcare, and hospitality converge. Our culture is fast-paced, collaborative, and endlessly ambitious—guided by our mantra: The only easy day was yesterday.

Meaningful Work Alongside Meaningful Relationships
Our interns don’t get side projects—they’re immersed in high-priority work from day one. You’ll collaborate directly with our teams to evaluate opportunities, design innovative solutions, and help deliver long-term value. With direct access to senior leadership, hands-on experience across our platform, and a culture that prizes ambition and curiosity, you’ll develop extraordinary skills in just ten weeks.

If you’re a bold, independent thinker who thrives on challenge, embraces complexity, and is excited by the opportunity to disrupt an industry through creativity, capital allocation, and compounding growth, Welltower is the place to launch your career.

Summary

The Cyber Security Intern joins Welltower's Security Analytics team, reporting to the Senior Manager, Security Analytics. This is a hands-on analyst role: you will help triage real alerts, assist with threat hunting and help surface detection gaps, and build the investigation runbooks and documentation that strengthen our incident response.

Over 10 weeks at 20-30 hours per week, you'll work alongside the Security Analytics team on live alerts and investigations, learning how a security team turns raw telemetry into decisions. You'll leave with real reps in the tools and workflows a working analyst uses every day, and with hands-on practice applying the MITRE ATT&CK framework to map real alerts and investigations to adversary techniques.

What You'll do

Capstone project: Work with the security team to identify a gap in our detection coverage and map it to the relevant MITRE ATT&CK tactic and technique. Work with the data owners and our MSSP to get the right telemetry, then build and test the detection and write the runbook to respond to it. You’ll present the result to security leadership and relevant vendors.

• Assist with triage: help work live alerts from our SIEM, EDR, and MDR partner in our ticketing system using established runbooks; gather the evidence and draft the verdict and reasoning for analyst review.
• Assist with threat hunting: help run guided hunts across endpoint, identity, email, and cloud telemetry, and document what you find.
• Help surface detection gaps: identify where coverage is missing, document the gap and the expected telemetry.
• Apply MITRE ATT&CK: map detection gaps and findings to adversary techniques to guide what coverage gets built.
• Build investigation runbooks: draft runbooks covering how to recognize an activity, what to pull, how to scope it, and when to elevate.
• Contribute to control improvements: based on what you see in investigations, document findings and observations that help the team strengthen security controls.
• Collaborate across teams: work with IT, service desk, and other departments to investigate and resolve security issues.
• Learn the MSSP partnership: work alongside our managed security partner to understand how escalations and alerts flow between their team and ours.
• Other duties as assigned.

Education:

Experience:

Required

• Currently pursuing a Bachelor's or Master's in Cybersecurity, Computer Science, Information Systems, or a related field.
• Working understanding of core security concepts: authentication and access control, the attack lifecycle (MITRE ATT&CK or cyber kill chain), common malware and phishing techniques, basic log analysis (can read a log and explain what happened).
• Familiarity with Windows and basic networking (TCP/IP, DNS, HTTP, common ports).
• Clear written communication - much of the role is turning evidence into a concise, accurate write-up.
• Comfortable asking questions and working with people outside the team (data owners, vendors).
• Motivated and proactive - brings initiative and would rather dig into a problem than wait to be told what to do.
• Coachable and self-directed - takes feedback well and runs with it.
• Takes pride in doing good work - follows through, owns the outcome, and flags questions or mistakes early.
• Curious and persistent, with sound judgment around sensitive data.

Nice to have

• Any query language (KQL, SQL, SPL, or similar).
• Python, PowerShell, or other scripting language.
• Experience mapping findings or coverage gaps to MITRE ATT&CK techniques.
• Familiarity with identity and email security concepts (MFA, OAuth/token abuse, phishing analysis, email headers).
• Hands-on exposure to any SIEM, EDR, cloud security tooling, or detection engineering - classroom, home lab, or CTF.
• Basic cloud platform familiarity (Microsoft Office 365, AWS, or Azure/Entra concepts).
• Experience writing technical documentation or procedures (runbooks, lab write-ups, class reports).

Employment is contingent upon the successful completion of a background check, drug screening, and verification of employment, education, and other credentials relevant to the position.

ABOUT WELLTOWER

Welltower® Inc. (NYSE: WELL) an S&P 500 company, is the world's preeminent residential wellness and healthcare infrastructure company. Our portfolio of ,2500+ Seniors and Wellness Housing communities is positioned at the intersection of housing, healthcare, and hospitality, creating vibrant communities for mature renters and older adults inthe United States,United Kingdom, andCanada.

Our real estate portfolio is unmatched, located in highly attractive micro-markets with stunning built environments.Yet, we are an unusual real estate organization as we view ourselves as a product company in a real estate wrapper driven by relationships and unconventional culture.

Through our disciplined approach to capital allocation powered by our data science platform and superior operating results driven by the Welltower Business System, we aspire to deliver long-term compounding of per share growth and returns for our existing investors – ourNorth Star.

Welltower is committed to leveraging the talent of a diverse workforce to create great opportunities for our business and our people. EOE/AA. Minority/Female/Sexual Orientation/Gender Identity/Disability/Vet

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.