Join the Enterprise Cyber Security team at Williams-Sonoma, Inc., where the Security Operations Center (SOC) helps safeguard associates, customers, systems, and data. You will support a 24x7 operations environment focused on monitoring enterprise security events, investigating suspicious activity, and coordinating response with Incident Response, Threat Intelligence, Detection Engineering, and technology partners.
What you’ll do
In this Level 2 SOC / Incident Response role, you will handle alert triage and event investigation, then execute coordinated incident response using established playbooks and escalation procedures. The work includes evidence analysis across endpoint, network, identity, and application signals, along with maintaining accurate documentation for continuous coverage.
- Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other monitoring platforms.
- Differentiate malicious activity from benign events by analyzing endpoint, network, identity, and application evidence.
- Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
- Perform authorized containment actions under established procedures and approval requirements, and promptly escalate actions outside delegated authority.
- Support incident investigations including evidence collection, timeline development, remediation coordination, and post-incident follow-up.
- Enrich investigations and coordinate endpoint response using CrowdStrike, Tanium, MISP, and related tools.
- Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
- Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
- Maintain accurate case notes, handoff documentation, and operational runbooks to support continuous operations.
- Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities as assigned.
- Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.
What you bring
- 3 years of experience in security operations, incident response, IT security, or a related technical field.
- Bachelor’s degree in Computer Science or related field, or equivalent work experience.
- Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
- Experience triaging alerts, investigating security events, and documenting findings.
- Familiarity with SIEM, EDR, case management, and escalation procedures.
- Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
- Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
- Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
- Basic scripting, automation, or AI-assisted analysis experience preferred.
- This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.
Tools you’ll use
- Google SecOps
- CrowdStrike
- Cortex XSOAR
- Google SecOps SOAR
- Tanium
- MISP
- SIEM
- EDR
Compensation and location
Brooklyn, NY (onsite). Salary range: USD 100,000 - 130,000 per year.
Benefits
- A generous discount on all WSI brands
- A 401(k) plan and other investment opportunities
- Paid vacations, holidays, and time off to volunteer
- Health benefits, dental and vision insurance, including same-sex domestic partner benefits
- Tax-free commuter benefits
- A wellness program that supports your physical, financial and emotional health
Learning and growth
- In-person and online learning opportunities through WSI University
- Cross-brand and cross-function career opportunities
- Resources for self-development
- Advisor (Mentor) program
- Career development workshops, learning programs, and speaker series
