Information Security Engineer - Cyber Threat Intelligence

Williams-Sonoma•San Francisco, CA

1d•Onsite

About The Position

The Information Security Engineer - Cyber Threat Intelligence will join the Enterprise Cyber Security organization, which protects WSI against emerging cyber threats. The role is part of the Cyber Threat Intelligence team, which collects, analyzes, and operationalizes threat information to support proactive threat hunting, detection engineering, and incident response. The engineer independently investigates emerging threats, manages indicators of compromise (IOCs), conducts threat hunts, and provides actionable intelligence to the SOC and Detection Engineering teams. The work spans intelligence research and hands-on security investigations to improve enterprise defenses. The position is onsite in the San Francisco, California office Monday through Thursday.

Requirements

At least 3 years of experience in cybersecurity operations, threat intelligence, threat hunting, or related security engineering.
Experience analyzing security telemetry, IOCs, attacker behaviors, and investigation evidence.
Working knowledge of SIEM, EDR, threat intelligence platforms, and MITRE ATT&CK.
Ability to develop investigative hypotheses, document conclusions, and collaborate with SOC and Detection Engineering.
Strong written communication, analytical thinking, and technical troubleshooting skills.

Nice To Haves

Hands-on experience with Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, or Any.Run.
Experience developing threat-hunting queries, enrichment scripts, or automated intelligence workflows.
Familiarity with retail/eCommerce threat patterns and intelligence-led vulnerability prioritization.

Responsibilities

Collect, validate, enrich, document, and distribute indicators of compromise and relevant threat intelligence.
Research threat actors, campaigns, tactics, techniques, and procedures affecting retail, eCommerce, and enterprise systems.
Conduct independent, hypothesis-driven threat hunts using endpoint, identity, network, and SIEM telemetry.
Partner with SOC and Detection Engineering to translate intelligence into detection use cases, hunting queries, and response guidance.
Use Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, and Any.Run to investigate, correlate, and operationalize threat information.
Monitor emerging vulnerabilities, exploitation activity, and relevant threats; communicate actionable prioritization to security and technology teams.
Map relevant adversary behavior and hunting findings to MITRE ATT&CK.
Produce concise intelligence reports, threat briefings, and investigative summaries for technical and leadership audiences.
Support incident investigations with IOC enrichment, campaign context, and related-activity analysis.
Develop repeatable workflows and appropriate automation or AI-assisted analysis while validating intelligence quality.

Benefits

A generous discount on all WSI brands.
A 401(k) plan and other investment opportunities.
Paid vacations, holidays, and time off to volunteer.
Health benefits, dental and vision insurance, including same-sex domestic partner benefits.
Tax-free commuter benefits.
A wellness program supporting physical, financial, and emotional health.
In-person and online learning opportunities through WSI University.
Cross-brand and cross-function career opportunities.
Resources for self-development.
Advisor (Mentor) program.
Career development workshops, learning programs, and speaker series.
Compensation may include merit and bonus opportunities.