Information Security Engineer - SOC and Incident Response

About the company

Williams-Sonoma

Retail · 10,001+ employees

What you'll do

• Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
• Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
• Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
• Perform authorized containment actions under established procedures and approval requirements; promptly escalate actions outside delegated authority.
• Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
• Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
• Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
• Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
• Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
• Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities, as assigned.
• Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.
• 3 years of experience in security operations, incident response, IT security, or a related technical field.
• Bachelor's degree in Computer Science or related field, or equivalent work experience
• Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
• Experience triaging alerts, investigating security events, and documenting findings.
• Familiarity with SIEM, EDR, case management, and escalation procedures.
• Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
• Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
• Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
• Basic scripting, automation, or AI-assisted analysis experience preferred.
• This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.
• A generous discount on all WSI brands
• A 401(k) plan and other investment opportunities
• Paid vacations, holidays, and time off to volunteer
• Health benefits, dental and vision insurance, including same-sex domestic partner benefits
• Tax-free commuter benefits
• A wellness program that supports your physical, financial and emotional health
• In-person and online learning opportunities through WSI University
• Cross-brand and cross-function career opportunities 
• Resources for self-development
• Advisor (Mentor) program
• Career development workshops, learning programs, and speaker series 

Keywords for your resumePro

The words this employer's screening is likely to look for.