Intelligence Intern - Cloud/Mobile (Remote) in London

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward.

Our University Recruiting program is dedicated to attracting and cultivating the future leaders of this industry. This program offers paid positions for students and recent grads, designed to provide exposure to work that makes an impact while being supported through a structured experience with seasoned professionals.

About The Role: This is a highly technical position on one of two teams within the Technical Analysis Cell (TAC), at the forefront of CrowdStrike's mission against nation state and criminal adversaries. Both teams are tasked with investigating, reconstructing and reverse engineering newly discovered, malicious artifacts and documenting analysis results as a stream of intelligence reporting.

Depending on the candidate's aptitude we can offer a role on one of two teams: The Mobile Mission or the Cloud Mission.

What You’ll Do:

• Maintain a detailed understanding of the technical details of cloud intrusions through analyzing cloud provider activity logs, such as AWS CloudTrail and Azure Activity Logs.
• Convert your understanding to an intelligence report.

What You’ll Need:

• Actively enrolled in a university, studying Computer Science, Cyber Security or related Master’s degree (expected graduation 2027).
• Familiarity with at least one cloud service provider (AWS, Azure, GCP) as a user, e.g., creating identities.
• Investigative mindset.
• Team player: someone who is eager to help, teach, and learn from others.
• Strong problem‑solving skills.
• Independent learner.

• Knowledge of programming and scripting languages, in particular Python.
• Ability to express complex technical and non‑technical concepts.
• Understanding of identity and access management for at least one major cloud service provider (AWS, Azure, GCP).
• Familiarity with at least one major cloud service provider’s activity logs (CloudTrail, Azure Activity logs, GCP Audit Logs).

What You’ll Do:

• Create tools to automate analysis tasks and tracking of threat actors.
• Contribute to active mitigation efforts with technical expertise.
• Track relations between new threats and existing actors using in‑house tools.
• Document threat evolutions and intelligence gaps for the broader Intelligence Team.
• Create host‑based and network‑based signatures suited for large‑scale hunting, detection, and tracking of threats.

What You’ll Need:

• Actively enrolled in a university, studying Computer Science, Cyber Security or related Master’s degree (expected graduation 2027).
• Team player: someone who is eager to help, teach, and learn from others.
• Malware‑analysis or knowledge of reverse‑engineering principles.
• First exposure to analyzing malware targeting mobile devices.
• Ability to reconstruct incidents based on cloud activity logs from at least one major cloud service provider (AWS, Azure, or GCP).
• Strong problem‑solving skills.
• Ability to express complex technical and non‑technical concepts.
• Ability to learn new analysis techniques quickly, especially when faced with less‑common file types.
• Solid writing skills.
• Knowledge of programming and scripting languages, in particular Python.

• Solid understanding of mobile platforms.
• Dynamic instrumentation frameworks.
• Experience identifying and classifying malicious tooling through development of signatures that can be used for tracking and hunting purposes.
• Familiarity with at least a couple of the following tools and languages: IDA, Ghidra, JEB, WinDbg, x86dbg/x64dbg, Parallels or VirtualBox, Java, C/C++, Rust, Golang, C#, .NET.

This is a 12‑week internship commencing on Monday 1st June and completing on Friday 21st August.

What You Can Expect:

• Market leader in compensation and equity awards.
• Paid holidays (including birthday holidays) and 401(k) matching (where applicable).
• Professional development opportunities including workshops, tech talks, and Executive Speaker Series.
• Assigned mentors from across the company for continuous support and feedback.
• Participation in company‑wide initiatives including FalconFIT, Wellness Programs, and Employee Assistance Program.
• Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections.
• Vibrant office culture with world‑class amenities.
• Ownership of impactful projects that move the company forward.
• Great Place to Work Certified™ across the globe.

CrowdStrike is proud to be an equal‑opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed.