The posting
Job Description
About the Team
You will lead the Cyber Threat Intelligence (CTI) and Security Operations (SOC) functions within the Cyber Security organization. This team is responsible for monitoring, detecting, investigating, and responding to cyber threats while continuously improving the organization's detection and response capabilities. This role reports to the Director of Cybersecurity and is a critically strategic domain within the WSI Security Governance program.
The CTI and SOC team's mission is to proactively defend the enterprise by leveraging intelligence-driven operations, detection engineering, incident response, and threat hunting to reduce cyber risk and enable secure business operations.
About the Role
As Manager, Cyber Threat Intelligence & Security Operations, you will lead a multidisciplinary team of Threat Intelligence Analysts, Detection Engineers, SOC Analysts, and Incident Responders. This is a hands-on technical leadership role where you will drive strategy, execution, and operations for this critical security domain while actively contributing to engineering and incident response efforts.
This role offers the opportunity to shape the future of cyber defense across a globally recognized portfolio of retail brands by building modern detection, response, intelligence, and automation capabilities.
Responsibilities
- Lead, mentor, and develop approximately 24 cybersecurity professionals across Threat Intelligence, Detection Engineering, Security Operations, Red Team, and Incident Response; think Player/Coach, someone coaching from experience gained from being a former individual contributor.
- Define, execute, and continuously mature the enterprise Cyber Threat Intelligence, Detection Engineering, and Security Operations strategy aligned to business risk.
- Lead the operation and continuous evolution of Google SecOps, CrowdStrike, Cortex XSOAR, MISP, Tanium, and supporting detection technologies.
- Direct enterprise cyber incident response from initial triage through containment, eradication, recovery, executive communications, and lessons learned.
- Drive proactive threat hunting, adversary tracking, IOC management, and intelligence collection and analysis.
- Lead Detection Engineering including SIEM content development, use-case creation, alert tuning, and continuous improvements in detection quality.
- Expand automation, orchestration and Ai-assisted capabilities to eliminate repetitive analyst work and accelerate investigation and response.
- Develop intelligence-driven detections based on emerging threat actor tactics, techniques, and procedures (TTPs).
- Lead Red Team operations including adversary emulation, penetration testing, purple team exercises, and validation of defensive controls and ensure Detection Engineering translates findings into improved detections and defensive capabilities.
- Partner with Security Engineering, Identity & Access Management, Enterprise Security Architecture, Legal, Privacy, Fraud, and Information Technology teams to strengthen enterprise cyber defenses.
- Provide hands-on support during major security incidents, investigations, platform integrations, and complex operational escalations.
- Establish and maintain operational standards, playbooks, investigation procedures, and best practices.
- Develop, track, and communicate key operational metrics and program maturity to executive leadership, driving continuous improvement through measurable outcomes.
- Lead audit, governance, regulatory investigations, and executive cyber threat reporting.
Basic Qualifications
- 7–10 years of progressive experience in Cyber Security with expertise in Security Operations, Threat Intelligence, Detection Engineering, and Incident Response.
- Proven experience managing technical teams and comfortable rolling up sleeves and logging into consoles to verify configurations and adjust settings.
- Demonstrated expertise across SIEM, SOAR, EDR, Threat Intelligence, endpoint security, penetration testing and incident response technologies.
- Experience developing and reporting operational metrics including MTTD, MTTR, detection coverage, alert fidelity, incident trends, automation effectiveness, and threat intelligence impact.
- Experience developing and executing a multi-year roadmap to mature the organization's SOC capabilities across people, process, technology, and automation.
- Strong understanding of enterprise networking, cloud, identity, operating systems, and modern attack techniques.
- Excellent communication, leadership, and cross-functional collaboration skills.
Preferred Qualifications
- Hands-on experience with Google SecOps, CrowdStrike, Cortex XSOAR, MISP, and Tanium.
- Experience building or maturing enterprise Detection Engineering and Threat Intelligence programs.
- Capable of delivering automation and scripting (Python, PowerShell, etc.); agentic AI experience is an emerging plus.
- Experience supporting regulatory investigations, governance, and compliance initiatives.
- Strong familiarity with MITRE ATT&CK and intelligence-driven defense methodologies.
About Williams-Sonoma, Inc.
Founded in 1956, Williams-Sonoma, Inc. is the premier specialty retailer of high-quality products for the home. Our family of brands includes Williams Sonoma, Pottery Barn, Pottery Barn Kids, PBteen, West Elm, Williams-Sonoma Home, Rejuvenation, and Mark and Graham. Today, we're a multi-brand, multi-channel, global enterprise supported by state-of-the-art technology and talented teams.
Benefits
Once you are here, you can look forward to a wide variety of benefits designed to help you grow personally and professionally, keep you healthy, prepare you for the unexpected, care for your family, and build a secure future.
- A generous associate discount across Williams-Sonoma brands
- 401(k) plan and investment opportunities
- Paid vacation, holidays, and time-off programs
- Comprehensive health, dental, and vision benefits
- Wellness and employee assistance programs
- Learning and development opportunities
- Cross-brand career opportunities
- Volunteer time and matching charitable donations
Continued Learning
- In-person and online learning opportunities through WSI University
- Cross-brand and cross-function career opportunities
- Resources for self-development
- Advisor (Mentor) program
- Career development workshops, learning programs, and speaker series
WSI will not now or in the future commence an immigration case or "sponsor" an individual for this position (for example, H-1B or other employment-based immigration).
This role is not eligible for relocation assistance.
Williams-Sonoma, Inc. is an Equal Opportunity Employer. Williams-Sonoma, Inc. will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance, or other applicable state or local laws and ordinances.
The expected starting pay range for this position is $170,000-$202,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities
