Choose a sample for the task in the posting
NIST's NICE Framework describes cybersecurity work through tasks, knowledge and skills. Use that distinction in your search. A monitoring sample and an access-review sample demonstrate different work.
| Task | A suitable sample | What the reviewer should understand |
|---|---|---|
| Alert triage | A note tied to specific events | Why it was flagged and what to investigate next |
| Access review | A fictional permissions register | Who owns each approval and which access remains unexplained |
| Defensive engineering | An authorized lab change with tests | The expected behavior and a case that should fail |
| Risk or control work | A control-to-evidence comparison | Whether the record shows the control happened, not just that a policy exists |
Sources[1]
Read the rule before running the script
Run triage_case.py with Python 3.10 or later. The fictional records contain four failures followed by success for account A, an unfamiliar-source success for B and one failure for C.
The first rule flags a success preceded by at least four failures for the same account within ten minutes. A failure exactly ten minutes before the success is included. The second rule flags a successful source absent from the account's supplied familiar-source list.
The expected output is two review notes: A for the failure sequence and B for the unfamiliar source. C does not meet either rule. That does not prove C is safe; it says only that these records did not trigger these checks.
Write a note that separates observation from explanation
A useful note preserves the event and its time window, identifies what is missing and asks for a permitted next step. It does not jump from unfamiliar location to attacker.
Example triage note for account B
One event imported four times can look like four attempts
The script counts records but has no unique event IDs. If an input feed repeats one failed login four times, it can satisfy the failure-count rule even though only one attempt occurred. This is a useful extension: add stable event identifiers and test how repeated imports are handled.
Do not deduplicate solely by account and timestamp; two genuine events might share them. Define the identity supplied by the data source. Then add tests for a success outside the time window, a shuffled input order and an invalid timestamp.
A passing test suite demonstrates the implemented rule on its fixtures. It does not establish real-world detection accuracy, complete log coverage or the absence of incidents. Keep real employer logs in approved systems; this project does not need them.
Ask which actions belong to an intern
Gartner's Summer 2027 IT posting includes an IT Security track alongside other assignments. Confirm track availability rather than assuming that an umbrella IT offer guarantees security work.
Ask who reviews your notes and which actions you may take. A well-written investigation record can be a strong intern contribution without independently disabling accounts or conducting tests on live systems. In your portfolio, show the rule, test results and one limitation you addressed.
Sources[2]