Information Security Engineer - Cyber Threat Intelligence

About the company

Williams-Sonoma

Retail · 10,001+ employees

What you'll do

• Collect, validate, enrich, document, and distribute indicators of compromise and relevant threat intelligence.
• Research threat actors, campaigns, tactics, techniques, and procedures affecting retail, eCommerce, and enterprise systems.
• Conduct independent, hypothesis-driven threat hunts using endpoint, identity, network, and SIEM telemetry.
• Partner with SOC and Detection Engineering to translate intelligence into detection use cases, hunting queries, and response guidance.
• Use Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, and Any.Run to investigate, correlate, and operationalize threat information.
• Monitor emerging vulnerabilities, exploitation activity, and relevant threats; communicate actionable prioritization to security and technology teams.
• Map relevant adversary behavior and hunting findings to MITRE ATT&CK.
• Produce concise intelligence reports, threat briefings, and investigative summaries for technical and leadership audiences.
• Support incident investigations with IOC enrichment, campaign context, and related-activity analysis.
• Develop repeatable workflows and appropriate automation or AI-assisted analysis while validating intelligence quality.
• 3+ years of experience in cybersecurity operations, threat intelligence, threat hunting, or related security engineering.
• Experience analyzing security telemetry, IOCs, attacker behaviors, and investigation evidence.
• Working knowledge of SIEM, EDR, threat intelligence platforms, and MITRE ATT&CK.
• Ability to develop investigative hypotheses, document conclusions, and collaborate with SOC and Detection Engineering.
• Strong written communication, analytical thinking, and technical troubleshooting skills.
• Hands-on experience with Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, or Any.Run preferred.
• Experience developing threat-hunting queries, enrichment scripts, or automated intelligence workflows preferred.
• Familiarity with retail/eCommerce threat patterns and intelligence-led vulnerability prioritization preferred.
• This role requires being onsite in the San Francisco, CA office Monday through Thursday. 
• A generous discount on all WSI brands
• A 401(k) plan and other investment opportunities
• Paid vacations, holidays, and time off to volunteer
• Health benefits, dental and vision insurance, including same-sex domestic partner benefits
• Tax-free commuter benefits
• A wellness program that supports your physical, financial and emotional health
• In-person and online learning opportunities through WSI University
• Cross-brand and cross-function career opportunities 
• Resources for self-development
• Advisor (Mentor) program
• Career development workshops, learning programs, and speaker series                                

Keywords for your resumePro

The words this employer's screening is likely to look for.