Fall 2026/Spring - Cyber Incident Response Analyst Intern - 90413071 -

Amtrak connects businesses and communities across the country while prioritizing the safety of its passengers, colleagues, the public, and its operating environment. The Cyber Incident Response Analyst Intern will support the Cyber Fusion Center in detecting, investigating, responding to, and recovering from cybersecurity threats and incidents, while helping develop documented processes, SOPs, workflow diagrams, and incident response exercises.

What you'll do:

• Cyber Incident Response Analysts during cyber incident investigations and response activities
• Observe and support incident response processes involving endpoint, network, cloud, and log-based investigations
• Assist with collecting, organizing, and documenting information related to security investigations and response activities
• Support the maintenance of incident records, lessons learned, and post-incident documentation
• Develop, review, and maintain incident response standard operating procedures, workflows, job aids, and process documentation
• Collaborate with team members to capture current-state operational processes and identify opportunities for process standardization
• Convert technical response activities into documented procedures that can be consistently followed during cyber incidents
• Assist with maintaining incident response playbooks and operational runbooks
• Create visual process maps, workflow diagrams, Swimlane diagrams, and response flowcharts that document Cyber Fusion Center operations
• Document relationships between Cyber Threat Intelligence, Threat Hunt, Threat Operations, Cyber Engineering, Threat Command Center, Incident Response, Legal, Crisis Management, and other stakeholder teams
• Develop diagrams illustrating incident response workflows, escalation paths, evidence collection processes, and communication procedures
• Support continuous improvement initiatives through documentation and visualization of operational processes

What they're looking for:

• Must be actively pursuing a Bachelor's or Master's degree from an accredited institution
• Must be enrolled in a Cybersecurity, Information Security, Computer Science, Information Technology, Digital Forensics, Cyber Operations, or related program
• Must have completed at least one year of undergraduate coursework or possess sophomore standing at minimum
• Must maintain a cumulative GPA of 2.8 or higher
• Must demonstrate strong written communication and technical documentation skills
• Cybersecurity fundamentals knowledge
• Network security knowledge
• Incident response knowledge
• Digital forensics knowledge

Benefits:

• Amtrak rail pass privileges as a part of the experience
• One (1) PTO day per academic year