Information Security Engineer SOC and Incident Response
About The Position
The Information Security Engineer - SOC / Incident Response provides Level 2 security operations support through alert triage, event investigation, and coordinated incident response. The role is part of the Enterprise Cyber Security organization and supports the Security Operations Center’s work monitoring enterprise security events, investigating suspicious activity, and coordinating with Incident Response, Threat Intelligence, Detection Engineering, and technology partners. The position participates in a 24x7 SOC rotation, including weekends, holidays, and assigned on-call coverage. It uses established playbooks, escalation procedures, and approved containment processes to protect enterprise systems. The role is onsite Monday through Thursday at the Rocklin, CA, San Jose, CA, or Brooklyn, NY office.
Requirements
- At least 3 years of experience in security operations, incident response, IT security, or a related technical field.
- Bachelor's degree in Computer Science or a related field, or equivalent work experience.
- Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
- Experience triaging alerts, investigating security events, and documenting findings.
- Familiarity with SIEM, EDR, case management, and escalation procedures.
- Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
Nice To Haves
- Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP.
- Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks.
- Basic scripting, automation, or AI-assisted analysis experience.
Responsibilities
- Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
- Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
- Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
- Perform authorized containment actions under established procedures and approval requirements, and promptly escalate actions outside delegated authority.
- Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
- Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
- Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
- Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
- Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
- Participate in 24x7 shift operations, including weekends, holidays, and assigned on-call responsibilities.
- Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.
Benefits
- A generous discount on all WSI brands.
- A 401(k) plan and other investment opportunities.
- Paid vacations, holidays, and time off to volunteer.
- Health benefits, including dental and vision insurance and same-sex domestic partner benefits.
- Tax-free commuter benefits.
- A wellness program supporting physical, financial, and emotional health.
- In-person and online learning opportunities through WSI University.
- Cross-brand and cross-function career opportunities.
- Resources for self-development.
- Advisor (Mentor) program.
- Career development workshops, learning programs, and speaker series.
- Bonus opportunities may be included in compensation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
