Information Security Engineer - Cyber Threat Intelligence
About The Position
As an Information Security Engineer - Cyber Threat Intelligence, you will independently investigate emerging threats, manage indicators of compromise (IOCs), conduct threat hunts, and provide actionable intelligence to the SOC and Detection Engineering teams. You will work across intelligence research and hands-on security investigations to help improve enterprise defenses. The role is part of the Enterprise Cyber Security organization, specifically the Cyber Threat Intelligence team, which collects, analyzes, and operationalizes threat information to support proactive threat hunting, detection engineering, and incident response. This position requires onsite work in the San Francisco, California office Monday through Thursday.
Requirements
- 3+ years of experience in cybersecurity operations, threat intelligence, threat hunting, or related security engineering.
- Experience analyzing security telemetry, IOCs, attacker behaviors, and investigation evidence.
- Working knowledge of SIEM, EDR, threat intelligence platforms, and MITRE ATT&CK.
- Ability to develop investigative hypotheses, document conclusions, and collaborate with SOC and Detection Engineering.
- Strong written communication, analytical thinking, and technical troubleshooting skills.
- Must work onsite in the San Francisco, CA office Monday through Thursday.
Nice To Haves
- Hands-on experience with Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, or Any.Run.
- Experience developing threat-hunting queries, enrichment scripts, or automated intelligence workflows.
- Familiarity with retail/eCommerce threat patterns and intelligence-led vulnerability prioritization.
Responsibilities
- Collect, validate, enrich, document, and distribute indicators of compromise and relevant threat intelligence.
- Research threat actors, campaigns, tactics, techniques, and procedures affecting retail, eCommerce, and enterprise systems.
- Conduct independent, hypothesis-driven threat hunts using endpoint, identity, network, and SIEM telemetry.
- Partner with SOC and Detection Engineering to translate intelligence into detection use cases, hunting queries, and response guidance.
- Use Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, and Any.Run to investigate, correlate, and operationalize threat information.
- Monitor emerging vulnerabilities, exploitation activity, and relevant threats; communicate actionable prioritization to security and technology teams.
- Map relevant adversary behavior and hunting findings to MITRE ATT&CK.
- Produce concise intelligence reports, threat briefings, and investigative summaries for technical and leadership audiences.
- Support incident investigations with IOC enrichment, campaign context, and related-activity analysis.
- Develop repeatable workflows and appropriate automation or AI-assisted analysis while validating intelligence quality.
Benefits
- A generous discount on all WSI brands.
- A 401(k) plan and other investment opportunities.
- Paid vacations, holidays, and time off to volunteer.
- Health benefits, dental and vision insurance, including same-sex domestic partner benefits.
- Tax-free commuter benefits.
- A wellness program that supports physical, financial, and emotional health.
- In-person and online learning opportunities through WSI University.
- Cross-brand and cross-function career opportunities.
- Resources for self-development.
- Advisor (Mentor) program.
- Career development workshops, learning programs, and speaker series.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
