The Role:

We are seeking a SOC Intern to join SoFi’s Cyber Security Operations Center (SOC) and gain hands-on experience helping defend the organization against real-world cyber threats. This internship offers the opportunity to work within a 24x7 Security Operations Center, supporting day-to-day detection and response activities while learning from experienced security analysts.

The SOC team is responsible for monitoring, analyzing, and responding to security events across SoFi’s infrastructure and applications.  As a SOC Intern, you will work closely with SOC Analysts across all shifts, as well as partner teams including Tools, Automation and Operations (TAO), Offensive Security, and Threat Research, to support investigations and improve operational effectiveness.

In this role, you’ll be exposed to real security incidents and learn how threats are detected, investigated, and remediated in a modern, enterprise-scale environment. This is a hands-on, learning-focused role designed to build foundational skills in security monitoring, incident response, and threat analysis.

What You’ll Do:

• Assist with security alert triage and monitoring across SOC detection tools.
• Support investigations of suspicious activity and potential security incidents under the guidance of senior analysts.
• Help collect, analyze, and document security artifacts such as logs, alerts, and indicators of compromise.
• Learn to use tools such as SIEM, EDR, email security, and threat intelligence platforms.
• Participate in incident response processes, including escalation, documentation, and post-incident review.
• Collaborate with SOC team members and cross-functional partners to improve detection quality and operational workflows.

What You’ll Need:

• Enrolled in an accredited US-based university (working towards a Bachelor’s or Master’s degree) with an expected graduation date of December 2026 or Spring 2027
• Must be returning to school for at least one quarter or semester after the internship
• Have no more than 12 months of professional full-time work experience (excluding internships and research assistant roles)
• Must be willing to relocate to San Francisco Bay Area and be available to work in the San Francisco HQ office at a hybrid capacity (2-3x a week)
• Foundational understanding of cybersecurity concepts and common threats, such as phishing, malware, account compromise, and unauthorized access.
• Basic knowledge of networking fundamentals, including TCP/IP, DNS, firewalls, and VPNs.
• Familiarity with Windows, macOS, and Linux operating systems.
• Interest in security monitoring, incident response, and SOC operations.
• Ability to analyze and interpret logs and alerts to identify suspicious or anomalous activity.
• Exposure to or coursework involving SIEM, EDR, or security monitoring tools (hands-on experience is a plus, but not required).
• Good written and verbal communication skills, with the ability to document findings clearly.
• Ability to work collaboratively as part of a team while taking ownership of assigned tasks.

Nice to Have:

• Hands-on experience through labs, coursework, personal projects, or internships related to security operations or incident response.
• Familiarity with SIEM platforms such as Splunk or Elastic.
• Basic understanding of endpoint security and malware analysis concepts.
• Exposure to MITRE ATT&CK or threat intelligence frameworks.
• Participation in CTFs, security competitions, labs, or home labs.
• Scripting or automation exposure (Python, Bash, or PowerShell).
• Relevant entry-level certifications or coursework (e.g., Security+, CCNA, cloud fundamentals).

Internship Perks:

• Access to senior leadership, including exclusive Q&A sessions with executives across all functions of SoFi
• Exclusive opportunities to deliver a case study to SoFi leaders 
• Development sessions for career, financial, and professional growth
• Opportunities to participate in company wide events like All-Hands and SoFi circles programming
• Networking socials to connect with fellow interns
• SoFi swag giveaways
• We offer incoming interns the flexibility to select from two potential start dates:
  • Cohort 1: Monday, June 1st, 2026 to Friday, August 21st, 2026
  • Cohort 2: Monday, June 15th, 2026 to Friday, September 4th, 2026