{"id":2573865,"url":"https://alion.io/job/williams-sonoma-information-security-engineer-cyber-threat-intelligence","title":"Information Security Engineer - Cyber Threat Intelligence","company":{"id":1885338,"name":"Williams-Sonoma","domain":"williams-sonomainc.com","url":"https://alion.io/company/williams-sonomainc","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":76,"open_postings":125,"ghost_share":0,"stale_share":0.976,"repost_share":0,"time_to_fill_p50_days":29,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":100000,"max":120000,"currency":"USD","period":"year","gross":null,"usd_annual":120000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Any.run","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Google SecOps","optional":false},{"name":"MISP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"VirusTotal","optional":false}],"status":"live","first_seen_at":"2026-10-14T22:43:36Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-23T03:28:47Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"About the Team\nYou will be part of the Enterprise Cyber Security organization responsible for protecting WSI against emerging cyber threats. The Cyber Threat Intelligence team collects, analyzes, and operationalizes threat information to support proactive threat hunting, detection engineering, and incident response.\nAbout the Role\nAs an Information Security Engineer - Cyber Threat Intelligence, you will independently investigate emerging threats, manage indicators of compromise (IOCs), conduct threat hunts, and provide actionable intelligence to the SOC and Detection Engineering teams. You will work across intelligence research and hands-on security investigations to help improve enterprise defenses.\nResponsibilities\nCollect, validate, enrich, document, and distribute indicators of compromise and relevant threat intelligence.\n\nResearch threat actors, campaigns, tactics, techniques, and procedures affecting retail, eCommerce, and enterprise systems.\n\nConduct independent, hypothesis-driven threat hunts using endpoint, identity, network, and SIEM telemetry.\n\nPartner with SOC and Detection Engineering to translate intelligence into detection use cases, hunting queries, and response guidance.\n\nUse Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, and Any.Run to investigate, correlate, and operationalize threat information.\n\nMonitor emerging vulnerabilities, exploitation activity, and relevant threats; communicate actionable prioritization to security and technology teams.\n\nMap relevant adversary behavior and hunting findings to MITRE ATT&CK.\n\nProduce concise intelligence reports, threat briefings, and investigative summaries for technical and leadership audiences.\n\nSupport incident investigations with IOC enrichment, campaign context, and related-activity analysis.\n\nDevelop repeatable workflows and appropriate automation or AI-assisted analysis while validating intelligence quality.\n\nCriteria\n3+ years of experience in cybersecurity operations, threat intelligence, threat hunting, or related security engineering.\n\nExperience analyzing security telemetry, IOCs, attacker behaviors, and investigation evidence.\n\nWorking knowledge of SIEM, EDR, threat intelligence platforms, and MITRE ATT&CK.\n\nAbility to develop investigative hypotheses, document conclusions, and collaborate with SOC and Detection Engineering.\n\nStrong written communication, analytical thinking, and technical troubleshooting skills.\n\nHands-on experience with Google SecOps, MISP, CrowdStrike, Feedly, VirusTotal, or Any.Run preferred.\n\nExperience developing threat-hunting queries, enrichment scripts, or automated intelligence workflows preferred.\n\nFamiliarity with retail/eCommerce threat patterns and intelligence-led vulnerability prioritization preferred.\n\nThis role requires being onsite in the San Francisco, CA office Monday through Thursday.\n\nOur Culture & Values\nWe believe that taking care of our people is vital to our success and we strive to offer equitable and transparent practices for all. We prioritize connection, growth, and wellbeing.\nPeople First\nPutting People First means investing in overall well-being and opportunities to grow and advance within the organization. Depending on the position and location, here are a few highlights of what benefits may be available:\nBenefits\nA generous discount on all WSI brands\n\nA 401(k) plan and other investment opportunities\n\nPaid vacations, holidays, and time off to volunteer\n\nHealth benefits, dental and vision insurance, including same-sex domestic partner benefits\n\nTax-free commuter benefits\n\nA wellness program that supports your physical, financial and emotional health\n\nContinued Learning\nIn-person and online learning opportunities through WSI University\n\nCross-brand and cross-function career opportunities\n\nResources for self-development\n\nAdvisor (Mentor) program\n\nCareer development workshops, learning programs, and speaker series\n\nWSI will not now or in the future commence an immigration case or \"sponsor\" an individual for this position (for example, H-1B or other employment-based immigration).\nThis role is not eligible for relocation assistance.\nWilliams-Sonoma, Inc. is an Equal Opportunity Employer. Williams-Sonoma, Inc. will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance, or other applicable state or local laws and ordinances.\nThe expected starting pay range for this position is $100,000 - $120,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities.","description_format":"text","description_chars":4798,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Relocation assistance","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Threat Intelligence","Information Security","Furniture","Kitchenware & Cookware"],"lifecycle":[{"event":"open","at":"2026-10-14T23:33:57Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 22 · green card filings: 7","filings_12m":22,"filings_prev_12m":48,"green_card_filings_12m":7,"median_offered_wage_usd":154914,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":7,"expected_fill_days":29,"reasons":["conf:1","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":120000,"is_top_pay":false},"html_url":"https://alion.io/job/williams-sonoma-information-security-engineer-cyber-threat-intelligence","json_url":"https://alion.io/job/williams-sonoma-information-security-engineer-cyber-threat-intelligence.json","meta":{"generated_at":"2026-10-23T05:21:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8826,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1885338},"rest":"https://alion.io/mcp/rest/get_company?id=1885338"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwilliams-sonoma-information-security-engineer-cyber-threat-intelligence"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwilliams-sonoma-information-security-engineer-cyber-threat-intelligence"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwilliams-sonoma-information-security-engineer-cyber-threat-intelligence"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/williams-sonoma-information-security-engineer-cyber-threat-intelligence\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwilliams-sonoma-information-security-engineer-cyber-threat-intelligence"}]}