Summer '27 Intern - Cyber Security

WELLTOWER - REIMAGINE REAL ESTATE WITH US

Welltower, now the world’s largest real estate company by market capitalization, is growing at an exciting pace! We’re transforming how the world thinks about senior living and wellness-focused real estate by making data-driven decisions-creating vibrant, purpose-driven communities where housing, healthcare, and hospitality converge. Our culture is fast-paced, collaborative, and endlessly ambitious-guided by our mantra: The only easy day was yesterday.

Meaningful Work Alongside Meaningful Relationships

Our interns don’t get side projects-they’re immersed in high-priority work from day one. You’ll collaborate directly with our teams to evaluate opportunities, design innovative solutions, and help deliver long-term value. With direct access to senior leadership, hands-on experience across our platform, and a culture that prizes ambition and curiosity, you’ll develop extraordinary skills in just ten weeks.

If you’re a bold, independent thinker who thrives on challenge, embraces complexity, and is excited by the opportunity to disrupt an industry through creativity, capital allocation, and compounding growth, Welltower is the place to launch your career.

Summary

The Cyber Security Intern joins Welltower's Security Analytics team, reporting to the Senior Manager, Security Analytics. This is a hands-on analyst role: you will help triage real alerts, assist with threat hunting and help surface detection gaps, and build the investigation runbooks and documentation that strengthen our incident response.

Over 10 weeks at 20-30 hours per week, you'll work alongside the Security Analytics team on live alerts and investigations, learning how a security team turns raw telemetry into decisions. You'll leave with real reps in the tools and workflows a working analyst uses every day, and with hands-on practice applying the MITRE ATT&CK framework to map real alerts and investigations to adversary techniques.

What You'll do

Capstone project: Work with the security team to identify a gap in our detection coverage and map it to the relevant MITRE ATT&CK tactic and technique. Work with the data owners and our MSSP to get the right telemetry, then build and test the detection and write the runbook to respond to it. You’ll present the result to security leadership and relevant vendors.

• Assist with triage: help work live alerts from our SIEM, EDR, and MDR partner in our ticketing system using established runbooks; gather the evidence and draft the verdict and reasoning for analyst review.
• Assist with threat hunting: help run guided hunts across endpoint, identity, email, and cloud telemetry, and document what you find.
• Help surface detection gaps: identify where coverage is missing, document the gap and the expected telemetry.
• Apply MITRE ATT&CK: map detection gaps and findings to adversary techniques to guide what coverage gets built.
• Build investigation runbooks: draft runbooks covering how to recognize an activity, what to pull, how to scope it, and when to escalate.
• Contribute to control improvements: based on what you see in investigations, document findings and observations that help the team strengthen security controls.
• Collaborate across teams: work with IT, service desk, and other departments to investigate and resolve security issues.
• Learn the MSSP partnership: work alongside our managed security partner to understand how escalations and alerts flow between their team and ours.
• Other duties as assigned.

Minimum Requirements

Education: Currently pursuing a Bachelor's or Master's in Cybersecurity, Computer Science, Information Systems, or a related field.

Experience: No experience required. Show us how you've gotten hands-on with security.

Required

• Currently pursuing a Bachelor's or Master's in Cybersecurity, Computer Science, Information Systems, or a related field.
• Working understanding of core security concepts: authentication and access control, the attack lifecycle (MITRE ATT&CK or cyber kill chain), common malware and phishing techniques, basic log analysis (can read a log and explain what happened).
• Familiarity with Windows and basic networking (TCP/IP, DNS, HTTP, common ports).
• Clear written communication - much of the role is turning evidence into a concise, accurate write-up.
• Comfortable asking questions and working with people outside the team (data owners, vendors).
• Motivated and proactive - brings initiative and would rather dig into a problem than wait to be told what to do.
• Coachable and self-directed - takes feedback well and runs with it.
• Takes pride in doing good work - follows through, owns the outcome, and flags questions or mistakes early.
• Curious and persistent, with sound judgment around sensitive data.

Nice to have

• Any query language (KQL, SQL, SPL, or similar).
• Python, PowerShell, or other scripting language.
• Experience mapping findings or coverage gaps to MITRE ATT&CK techniques.
• Familiarity with identity and email security concepts (MFA, OAuth/token abuse, phishing analysis, email headers).
• Hands-on exposure to any SIEM, EDR, cloud security tooling, or detection engineering - classroom, home lab, or CTF.
• Basic cloud platform familiarity (Microsoft Office 365, AWS, or Azure/Entra concepts).
• Experience writing technical documentation or procedures (runbooks, lab write-ups, class reports).

Employment is contingent upon the successful completion of a background check, drug screening, and verification of employment, education, and other credentials relevant to the position.

ABOUT WELLTOWER

Welltower® Inc. (NYSE: WELL) an S&P 500 company, is the world's preeminent residential wellness and healthcare infrastructure company. Our portfolio of ,2500+ Seniors and Wellness Housing communities is positioned at the intersection of housing, healthcare, and hospitality, creating vibrant communities for mature renters and older adults in the United States, United Kingdom, and Canada.

Our real estate portfolio is unmatched, located in highly attractive micro-markets with stunning built environments. Yet, we are an unusual real estate organization as we view ourselves as a product company in a real estate wrapper driven by relationships and unconventional culture.

Through our disciplined approach to capital allocation powered by our data science platform and superior operating results driven by the Welltower Business System, we aspire to deliver long-term compounding of per share growth and returns for our existing investors - our North Star.

Welltower is committed to leveraging the talent of a diverse workforce to create great opportunities for our business and our people. EOE/AA. Minority/Female/Sexual Orientation/Gender Identity/Disability/Vet