Information Security Engineer - Cyber Threat Intelligence

Job-ID: 20681Location: San Francisco, CA, United StatesSchedule: Full time, DayPosted: 2026-10-14About the Team You will be part of the Enterprise Cyber Security organization responsible for protecting WSI against emerging cyber threats. The Cyber Threat Intelligence team collects, analyzes, and operationalizes threat information to support proactive threat hunting, detection engineering, and incident response.About the Role As an Information Security Engineer - Cyber Threat Intelligence, you will independently investigate emerging threats, manage indicators of compromise (IOCs), conduct threat hunts, and provide actionable intelligence to the SOC and Detection Engineering teams. You will work across intelligence research and hands-on security investigations to help improve enterprise defenses.Responsibilities Collect, validate, enrich, document, and distribute indicators of compromise and relevant threat intelligence.Research threat actors, campaigns, tactics, techniques, and procedures affecting retail, eCommerce, and enterprise systems.Conduct independent, hypothesis-driven threat hunts using endpoint, identity, network, and SIEM telemetry.Partner with SOC and Detection Engineering to translate intelligence into detection use cases, hunting queries, and response guidance.Use Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, and Any.Run to investigate, correlate, and operationalize threat information.Monitor emerging vulnerabilities, exploitation activity, and relevant threats; communicate actionable prioritization to security and technology teams.Map relevant adversary behavior and hunting findings to MITRE ATT&CK.Produce concise intelligence reports, threat briefings, and investigative summaries for technical and leadership audiences.Support incident investigations with IOC enrichment, campaign context, and related-activity analysis.Develop repeatable workflows and appropriate automation or AI-assisted analysis while validating intelligence quality.Criteria3+ years of experience in cybersecurity operations, threat intelligence, threat hunting, or related security engineering.Experience analyzing security telemetry, IOCs, attacker behaviors, and investigation evidence.Working knowledge of SIEM, EDR, threat intelligence platforms, and MITRE ATT&CK.Ability to develop investigative hypotheses, document conclusions, and collaborate with SOC and Detection Engineering.Strong written communication, analytical thinking, and technical troubleshooting skills.Hands-on experience with Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, or Any.Run preferred.Experience developing threat-hunting queries, enrichment scripts, or automated intelligence workflows preferred.Familiarity with retail/eCommerce threat patterns and intelligence-led vulnerability prioritization preferred.This role requires being onsite in the San Francisco, CA office Monday through Thursday.Our Culture & Values We believe that taking care of our people is vital to our success and we strive to offer equitable and transparent practices for all. We prioritize connection, growth, and wellbeing. People First Putting People First means investing in overall well-being and opportunities to grow and advance within the organization. Depending on the position and location, here are a few highlights of what benefits may be available:BenefitsA generous discount on all WSI brandsA 401(k) plan and other investment opportunitiesPaid vacations, holidays, and time off to volunteerHealth benefits, dental and vision insurance, including same-sex domestic partner benefitsTax-free commuter benefitsA wellness program that supports your physical, financial and emotional healthContinued LearningIn-person and online learning opportunities through WSI UniversityCross-brand and cross-function career opportunities Resources for self-developmentAdvisor (Mentor) programCareer development workshops, learning programs, and speaker series WSI will not now or in the future commence an immigration case or "sponsor" an individual for this position (for example, H-1B or other employment-based immigration).This role is not eligible for relocation assistance.Williams-Sonoma, Inc. is an Equal Opportunity Employer. Williams-Sonoma, Inc. will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance, or other applicable state or local laws and ordinances.The expected starting pay range for this position is $100,000 - $120,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities.About the companyOur Company Founded in 1956, Williams-Sonoma, Inc. is the premier specialty retailer of high-quality products for the kitchen and home in the United States. Our family of brands are Williams Sonoma, Williams Sonoma Home, Pottery Barn, Pottery Barn Kids, Pottery Barn Teen, Rejuvenation, West Elm, Mark & Graham, Outward, and GreenRow. These brands are among the best known and most respected in the industry. We offer beautifully-designed, stylish and functional products for every area of the home, including the kitchen, living room, bedroom, home office, closet, laundry room and even outdoor spaces. We've seen some big changes since our first brick-and-mortar store opened more than half of a century ago. What hasn't changed is our passion for high-quality products, functional design, outstanding customer service, and enhancing the lives of our customers and the communities where we operate. Today, we're a multi-brand, multi-channel, global enterprise supported by state-of-the-art technology and some of the most talented teams in retailing - and we're always looking for new energy and ideas.