SOC & Incident Response Engineer — 24/7 On-Call Ops

Williams-Sonoma, Inc.; San Jose (CA); On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

Discount on Williams-Sonoma brands

401(k) plan and other opportunities

Paid vacations, holidays, and time off

Health, dental and vision insurance

Tax-free commuter benefits

Wellness program

Job summary

Williams-Sonoma, Inc. is seeking an Information Security Engineer - SOC/Incident Response to join the Enterprise Cyber Security organization in Rocklin, CA / San Jose, CA / Brooklyn, NY.

You will contribute to 24x7 security operations, triage alerts, investigate incidents, and coordinate containment and remediation with cross-functional teams. Ideal candidates have hands-on experience with SIEM/EDR, playbooks, and threat intel, and can work in a high-tempo environment while documenting findings

Qualifications

• 3 years of experience in security operations, incident response, IT security, or a related field.
• Bachelor's degree in Computer Science or related field, or equivalent work experience.
• Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
• Experience triaging alerts, investigating security events, and documenting findings.
• Familiarity with SIEM, EDR, case management, and escalation procedures.
• Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
• Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
• Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
• Basic scripting, automation, or AI-assisted analysis experience preferred.
• This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.

Responsibilities

• Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
• Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
• Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
• Perform authorized containment actions under established procedures and approval requirements; promptly escape actions outside delegated authority.
• Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
• Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
• Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
• Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
• Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
• Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities, as assigned.
• Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.

Skills

Security operations

Incident response

IT security

SIEM/EDR familiarity

Communication during time-sensitive

Scripting/automation basics

On-call / 24x7 readiness

Education

Bachelor's degree in Computer Science or related field

Tools

Google SecOps

CrowdStrike

Cortex XSOAR

Tanium

MISP

Job description

Williams-Sonoma, Inc. is seeking an Information Security Engineer - SOC/Incident Response to join the Enterprise Cyber Security organization in Rocklin, CA / San Jose, CA / Brooklyn, NY.

You will contribute to 24x7 security operations, triage alerts, investigate incidents, and coordinate containment and remediation with cross-functional teams. Ideal candidates have hands-on experience with SIEM/EDR, playbooks, and threat intel, and can work in a high-tempo environment while documenting findings