Information Security Engineer - SOC and Incident Response

Williams-Sonoma, Inc.; San Jose (CA); On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

Discount on Williams-Sonoma brands

401(k) plan and other opportunities

Paid vacations, holidays, and time off

Health, dental and vision insurance

Tax-free commuter benefits

Wellness program

Job summary

Williams-Sonoma, Inc. is seeking an Information Security Engineer - SOC/Incident Response to join the Enterprise Cyber Security organization in Rocklin, CA / San Jose, CA / Brooklyn, NY.

You will contribute to 24x7 security operations, triage alerts, investigate incidents, and coordinate containment and remediation with cross-functional teams. Ideal candidates have hands-on experience with SIEM/EDR, playbooks, and threat intel, and can work in a high-tempo environment while documenting findings

Qualifications

• 3 years of experience in security operations, incident response, IT security, or a related field.
• Bachelor's degree in Computer Science or related field, or equivalent work experience.
• Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
• Experience triaging alerts, investigating security events, and documenting findings.
• Familiarity with SIEM, EDR, case management, and escalation procedures.
• Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
• Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
• Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
• Basic scripting, automation, or AI-assisted analysis experience preferred.
• This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.

Responsibilities

• Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
• Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
• Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
• Perform authorized containment actions under established procedures and approval requirements; promptly escape actions outside delegated authority.
• Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
• Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
• Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
• Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
• Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
• Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities, as assigned.
• Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.

Skills

Security operations

Incident response

IT security

SIEM/EDR familiarity

Communication during time-sensitive

Scripting/automation basics

On-call / 24x7 readiness

Education

Bachelor's degree in Computer Science or related field

Tools

Google SecOps

CrowdStrike

Cortex XSOAR

Tanium

MISP

Job description

Job Description

About the Team

You will be part of the Enterprise Cyber Security organization responsible for protecting WSI associates, customers, systems, and data. The Security Operations Center (SOC) monitors enterprise security events, investigates suspicious activity, and coordinates response with Incident Response, Threat Intelligence, Detection Engineering, and technology partners.

About The Role

As an Information Security Engineer - SOC / Incident Response, you will provide Level 2 security operations support through alert triage, event investigation, and coordinated incident response. You will participate in a 24x7 SOC rotation, including weekends, holidays, and on-call coverage as assigned, and use established playbooks and escalation procedures to protect enterprise systems.

Responsibilities

• Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
• Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
• Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
• Perform authorized containment actions under established procedures and approval requirements; promptly escape actions outside delegated authority.
• Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
• Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
• Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
• Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
• Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
• Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities, as assigned.
• Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.

Criteria

• 3 years of experience in security operations, incident response, IT security, or a related technical field.
• Bachelor's degree in Computer Science or related field, or equivalent work experience
• Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
• Experience triaging alerts, investigating security events, and documenting findings.
• Familiarity with SIEM, EDR, case management, and escalation procedures.
• Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
• Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
• Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
• Basic scripting, automation, or AI-assisted analysis experience preferred.
• This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.

Our Culture & Values

We believe that taking care of our people is vital to our success and we strive to offer equitable and transparent practices for all. We prioritize connection, growth, and wellbeing.

People First

Putting People First means investing in overall well-being and opportunities to grow and advance within the organization. Depending on the position and location, here are a few highlights of what benefits may be available:

Benefits

• A generous discount on all WSI brands
• A 401(k) plan and other investment opportunities
• Paid vacations, holidays, and time off to volunteer
• Health benefits, dental and vision insurance, including same-sex domestic partner benefits
• Tax-free commuter benefits
• A wellness program that supports your physical, financial and emotional health

Continued Learning

• In-person and online learning opportunities through WSI University
• Cross-brand and cross-function career opportunities
• Resources for self-development
• Advisor (Mentor) program
• Career development workshops, learning programs, and speaker series

WSI will not now or in the future commence an immigration case or "sponsor" an individual for this position (for example, H-1B or other employment-based immigration).

This role is not eligible for relocation assistance.

Williams-Sonoma, Inc. is an Equal Opportunity Employer. Williams-Sonoma, Inc. will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance, or other applicable state or local laws and ordinances.

The expected starting pay range for this position is $100,000 - $130,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities

About Us

Our Company

Founded in 1956, Williams-Sonoma, Inc. is the premier specialty retailer of high-quality products for the kitchen and home in the United States. Our family of brands are Williams Sonoma, Williams Sonoma Home, Pottery Barn, Pottery Barn Kids, Pottery Barn Teen, Rejuvenation, West Elm, Mark & Graham, Outward, and GreenRow. These brands are among the best known and most respected in the industry. We offer beautifully-designed, stylish and functional products for every area of the home, including the kitchen, living room, bedroom, home office, closet, laundry room and even outdoor spaces. We’ve seen some big changes since our first brick-and-mortar store opened more than half of a century ago. What hasn’t changed is our passion for high-quality products, functional design, outstanding customer service, and enhancing the lives of our customers and the communities where we operate. Today, we’re a multi-brand, multi-channel, global enterprise supported by state-of-the-art technology and some of the most talented teams in retailing - and we’re always looking for new energy and ideas.