Job DescriptionAs an Information Security Engineer - SOC / Incident Response, you will provide Level 2 security operations support through alert triage, event investigation, and coordinated incident response. You will participate in a 24x7 SOC rotation, including weekends, holidays, and on-call coverage as assigned, and use established playbooks and escalation procedures to protect enterprise systems.
Responsibilities
- Triage, investigate, and document security alerts and events from Google SecOps, CrowdStrike, and other security monitoring platforms.
- Analyze endpoint, network, identity, and application evidence to distinguish malicious activity from benign events.
- Execute approved investigation and response playbooks through Cortex XSOAR and/or Google SecOps SOAR.
- Perform authorized containment actions under established procedures and approval requirements; promptly escalate actions outside delegated authority.
- Support incident investigations, evidence collection, timeline development, remediation coordination, and post-incident follow-up.
- Use CrowdStrike, Tanium, MISP, and related tools to enrich investigations and coordinate endpoint response.
- Escalate significant incidents and complex technical issues to senior responders, Incident Response leadership, and designated incident command roles.
- Partner with Cyber Threat Intelligence and Detection Engineering on threat hunts, detection feedback, and alert-quality improvements.
- Maintain accurate case notes, handoff documentation, and operational runbooks for continuous coverage.
- Participate in 24x7 shift operations, including weekends, holidays, and on-call responsibilities, as assigned.
- Identify opportunities for safe automation and AI-assisted investigative efficiency while validating results and following response controls.
Criteria
- 3 years of experience in security operations, incident response, IT security, or a related technical field.
- Bachelor's degree in Computer Science or related field, or equivalent work experience
- Foundational knowledge of security monitoring, endpoint security, operating systems, networking, and common attack techniques.
- Experience triaging alerts, investigating security events, and documenting findings.
- Familiarity with SIEM, EDR, case management, and escalation procedures.
- Ability to work effectively in a 24x7 operational environment and communicate clearly during time-sensitive events.
- Experience with Google SecOps, CrowdStrike, Cortex XSOAR, Google SecOps SOAR, Tanium, or MISP preferred.
- Experience supporting endpoint containment, evidence handling, threat hunting, or response playbooks preferred.
- Basic scripting, automation, or AI-assisted analysis experience preferred.
- This role requires being onsite in the Rocklin, CA, San Jose, CA or Brooklyn, NY office Monday through Thursday.
People First Putting People First means investing in overall well-being and opportunities to grow and advance within the organization. Depending on the position and location, here are a few highlights of what benefits may be available:
Benefits
- A generous discount on all WSI brands
- A 401(k) plan and other investment opportunities
- Paid vacations, holidays, and time off to volunteer
- Health benefits, dental and vision insurance, including same-sex domestic partner benefits
- Tax-free commuter benefits
- A wellness program that supports your physical, financial and emotional health
Continued Learning
- In-person and online learning opportunities through WSI University
- Cross-brand and cross-function career opportunities
- Resources for self-development
- Advisor (Mentor) program
- Career development workshops, learning programs, and speaker series
This role is not eligible for relocation assistance.
The expected starting pay range for this position is $100,000 - $130,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities.
