Find your next role

Introduction

At IBM, we’re redefining the future of cybersecurity by combining human expertise with cutting-edge technology. As a SIEM Engineer Intern, you’ll join our Managed Security Services organization , a global leader in security monitoring, analytics, and threat detection , and gain hands-on experience with enterprise grade SIEM platforms including IBM QRadar, Splunk Enterprise Security, Microsoft Sentinel, and Palo Alto XSIAM.

This role is designed for recent graduates or final-year university students who are passionate about cybersecurity and eager to build a foundation in threat detection, incident response, and security engineering. You’ll be guided by experienced professionals and contribute to protecting some of the world’s largest organizations against evolving cyber threats.

In this role, you'll work in one of our IBM Consulting Client Innovation Centers (Delivery Centers), where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world. Our delivery centers offer our clients locally based skills and technical expertise to drive innovation and adoption of new technology.

Your role and responsibilities

As a SIEM Engineer (Intern), you will support IBM’s Security Operations Center (SOC) teams in maintaining and enhancing clients’ detection and monitoring capabilities.
You will gain exposure to multiple SIEM technologies while developing the analytical and technical skills essential for a career in cybersecurity.

Key responsibilities include:

• Assist in policy and correlation rule management across different SIEM platforms.
• Support weekly and monthly trend analysis on security events, policy exceptions, and user behavior patterns.
• Help reduce false positives and false negatives by analyzing alerts and tuning detection rules.
• Collaborate with senior engineers to optimize and refine detection logic based on compliance frameworks and customer feedback.
• Participate in the creation and testing of new correlation rules through formal change management processes.
• Support system administration tasks, including health monitoring, patching, and configuration validation.
• Contribute to documentation, including standard operating procedures (SOPs), policy baselines, and detection use-case repositories.
• Perform reporting and data visualization of trends, detection coverage, and operational performance.
• Stay informed on emerging threats and vulnerabilities to assist in enhancing SIEM content.
• Work closely with cross-functional teams to ensure security visibility and accuracy across platforms.

Required education

High School Diploma/GED

Preferred education

Technical Diploma

Required technical and professional expertise

• Bachelor’s degree (completed or in final semester) in Computer Science, Information Systems, Cybersecurity, or a related field.
• Strong interest in cybersecurity operations, SIEM engineering, and threat detection.
• Basic understanding of:
  • Networking concepts (TCP/IP, routing, OSI model)
  • Operating systems (Windows, Linux/UNIX)
  • Security fundamentals (events, logs, alerts, incident response)
• Analytical and troubleshooting mindset with strong attention to detail.
• Excellent written and verbal communication skills in English.
• Ability to work in a collaborative and fast-paced environment.

Preferred technical and professional experience

• Basic experience in scripting or automation (Python, Bash, or PowerShell).
• Understanding of log management, data parsing, and correlation rule logic.
• Awareness of cloud and hybrid security environments (Azure, AWS, GCP).