About the Role Help us protect CrowdStrike and its customers from the most advanced threats! CrowdStrike’s Machine Learning Operations, Response and Evaluation team is the gatekeeper of Falcon’s groundbreaking security detections that rely on Machine Learning models. Join us in improving these models through a variety of operational tasks.

What you’ll do As a Machine Learning Operations, Response and Evaluation intern, you will assist in performing activities related to various aspects of security operations and data science. These tasks include but are not limited to:

• Review Machine Learning detections by analyzing relevant data at scale
• Improving detections
• Reverse engineer malware binaries of different file types
• Learn to determine a file’s legitimacy (identifying how malicious or clean a file is)
• Learn about OS internals and living off-the-land (LOL) techniques
• Responding to customer and support escalations about False Positives and False Negatives
• Get exposure to adversarial emulation work such as kill-chains, adversary techniques, etc.
• Identify process and tooling gaps that can improve daily operations of the team
• Deliver a key project at the end of the internship period that highlights what you’ve learned, and how you’ve applied those learnings

Key Qualifications

• Pursuing an Undergraduate (in third or final year) or Masters Degree within a relevant field/degree subject area
• Passionate about cyber security, security operations, malware analysis or reverse engineering
• Interest in understanding exploitation tradecraft and actor tactics, techniques and procedures (TTPs)
• Have some knowledge/experience on Machine Learning/Artificial Intelligence
• Highly organized and self-sufficient

Bonus Points

• If you have experience with programming languages (C++, GoLang, DotNet, etc) or scripting languages (Python, Bash, PowerShell, etc. - Python is strongly preferred)
• If you have experience in using a post-exploitation framework (for example Metasploit)
• If you have some understanding of OS internals (for example, you are familiar with Win32 API calls on Windows)
• If you know what a kill-chain is and you’ve previously heard about the MITRE ATT&CK Framework