Job description

About the Team You will be part of the Enterprise Cyber Security organization responsible for protecting Williams-Sonoma, Inc. through reliable, scalable security platforms and automation. The Security DevSecOps function partners with Security Operations, Incident Response, Threat Intelligence, Security Engineering, Identity & Access Management, and Infrastructure to build software and integrations that improve the effectiveness of enterprise security operations. The team’s mission is to reduce repetitive manual work, strengthen response capabilities, and deliver secure, maintainable software and automation that support our associates, customers, and business. About the Role As an Information Security Engineer - DevSecOps, you will design, develop, deploy, and support SOAR playbooks, workflow automations, platform integrations, and custom applications used by the Enterprise Cyber Security team. This is a hands-on engineering role with end-to-end responsibility for solution design, coding, testing, deployment, documentation, and production support. You will balance SOAR development, security automation, and custom software development while working closely with operational teams to translate security requirements into dependable technical solutions. Responsibilities • Design, develop, test, deploy, and maintain SOAR playbooks and response workflows in Google SecOps SOAR and Palo Alto Cortex XSOAR. • Build custom security applications, reusable services, scripts, and workflow automations that improve investigation, enrichment, triage, and response processes. • Develop and maintain secure integrations using REST APIs, JSON, webhooks, and platform SDKs across Google SecOps SIEM, CrowdStrike, Tanium, Ping Identity, Delinea, MISP, and other enterprise systems. • Own the full software development lifecycle, including requirements analysis, solution design, source control, testing, release management, documentation, and ongoing production maintenance. • Apply Python and PowerShell to automate repeatable security operations tasks; use Git and CI/CD practices to manage versioning, code review, and controlled releases. • Use Docker and container-based development practices, and Terraform or other infrastructure-as-code approaches where appropriate for repeatable deployments. • Partner with SOC, Incident Response, Threat Intelligence, Security Engineering, IAM, and Infrastructure teams to identify automation opportunities and translate operational needs into technical requirements. • Troubleshoot failed playbooks, API integrations, custom applications, and production workflows; conduct root-cause analysis and implement durable fixes. • Build appropriate safeguards into automations, including least-privilege access, credential protection, audit logging, error handling, testing, approval gates, and rollback procedures for disruptive actions. • Participate in an on-call rotation supporting production SOAR automations, integrations, and custom security applications. • Evaluate AI-assisted development and agentic automation opportunities, applying human review, security controls, and validation before production adoption. • Maintain clear technical documentation, runbooks, and knowledge transfer materials to support reliable operations and cross-team collaboration. Criteria • 3+ years of experience in information security engineering, software development, DevSecOps, security automation, or a related technical discipline. • Bachelor's degree in Computer Science or related field, or equivalent work experience. • Hands-on software development and scripting experience using Python and PowerShell, with working knowledge of REST APIs and JSON. • Experience building, testing, and maintaining automation workflows, platform integrations, or custom applications in production environments. • Working knowledge of SIEM, SOAR, endpoint security, identity, and threat intelligence concepts and operational workflows. • Experience with Git-based source control, CI/CD practices, software testing, and secure development principles. • Familiarity with Docker or containers and infrastructure-as-code tools such as Terraform. • Strong analytical, troubleshooting, documentation, and communication skills; ability to work effectively across security and infrastructure teams. • Willingness to participate in an on-call rotation for supported production services. • Experience developing playbooks and integrations in Google SecOps SOAR or Palo Alto Cortex XSOAR preferred. • Hands-on experience integrating Google SecOps SIEM, CrowdStrike, Tanium, Ping Identity, Delinea, or MISP preferred. • Experience designing reusable automation frameworks, custom APIs, or internal security applications preferred. • Familiarity with incident response processes, detection engineering, and threat intelligence enrichment workflows preferred. • Experience with AI-assisted software development or agentic AI workflows, including appropriate testing, oversight, and security controls preferred. • Experience supporting hybrid on-premises and cloud infrastructure in a large enterprise environment preferred. • This role requires being onsite in the Rocklin, CA office Monday through Thursday. Our Culture & Values We believe that taking care of our people is vital to our success and we strive to offer equitable and transparent practices for all. We prioritize connection, growth, and wellbeing. People First Putting People First means investing in overall well-being and opportunities to grow and advance within the organization. Depending on the position and location, here are a few highlights of what benefits may be available: Benefits • A generous discount on all WSI brands • A 401(k) plan and other investment opportunities • Paid vacations, holidays, and time off to volunteer • Health benefits, dental and vision insurance, including same-sex domestic partner benefits • Tax-free commuter benefits • A wellness program that supports your physical, financial and emotional health Continued Learning • In-person and online learning opportunities through WSI University • Cross-brand and cross-function career opportunities • Resources for self-development • Advisor (Mentor) program • Career development workshops, learning programs, and speaker series WSI will not now or in the future commence an immigration case or "sponsor" an individual for this position (for example, H-1B or other employment-based immigration). This role is not eligible for relocation assistance. Williams-Sonoma, Inc. is an Equal Opportunity Employer. Williams-Sonoma, Inc. will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance, or other applicable state or local laws and ordinances. The expected starting pay range for this position is $90,000 - $110,000. Applicable pay ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. In addition to competitive pay, compensation may include a variety of other components like benefits, paid time off, merit, and bonus opportunities.

Requirements

Must-haves

About the Team
The team’s mission is to reduce repetitive manual work, strengthen response capabilities, and deliver secure, maintainable software and automation that support our associates, customers, and business.
Design, develop, test, deploy, and maintain SOAR playbooks and response workflows in Google SecOps SOAR and Palo Alto Cortex XSOAR.
Build custom security applications, reusable services, scripts, and workflow automations that improve investigation, enrichment, triage, and response processes.
Develop and maintain secure integrations using REST APIs, JSON, webhooks, and platform SDKs across Google SecOps SIEM, CrowdStrike, Tanium, Ping Identity, Delinea, MISP, and other enterprise systems.
Own the full software development lifecycle, including requirements analysis, solution design, source control, testing, release management, documentation, and ongoing production maintenance.
Apply Python and PowerShell to automate repeatable security operations tasks; use Git and CI/CD practices to manage versioning, code review, and controlled releases.
Use Docker and container-based development practices, and Terraform or other infrastructure-as-code approaches where appropriate for repeatable deployments.
Partner with SOC, Incident Response, Threat Intelligence, Security Engineering, IAM, and Infrastructure teams to identify automation opportunities and translate operational needs into technical requirements.
Troubleshoot failed playbooks, API integrations, custom applications, and production workflows; conduct root-cause analysis and implement durable fixes.
Build appropriate safeguards into automations, including least-privilege access, credential protection, audit logging, error handling, testing, approval gates, and rollback procedures for disruptive actions.
Participate in an on-call rotation supporting production SOAR automations, integrations, and custom security applications.
Evaluate AI-assisted development and agentic automation opportunities, applying human review, security controls, and validation before production adoption.
Maintain clear technical documentation, runbooks, and knowledge transfer materials to support reliable operations and cross-team collaboration.
3+ years of experience in information security engineering, software development, DevSecOps, security automation, or a related technical discipline.
Bachelor's degree in Computer Science or related field, or equivalent work experience.
Hands-on software development and scripting experience using Python and PowerShell, with working knowledge of REST APIs and JSON.
Experience building, testing, and maintaining automation workflows, platform integrations, or custom applications in production environments.

Nice-to-haves

Experience developing playbooks and integrations in Google SecOps SOAR or Palo Alto Cortex XSOAR preferred.
Hands-on experience integrating Google SecOps SIEM, CrowdStrike, Tanium, Ping Identity, Delinea, or MISP preferred.
Experience designing reusable automation frameworks, custom APIs, or internal security applications preferred.
Familiarity with incident response processes, detection engineering, and threat intelligence enrichment workflows preferred.
Experience with AI-assisted software development or agentic AI workflows, including appropriate testing, oversight, and security controls preferred.
Experience supporting hybrid on-premises and cloud infrastructure in a large enterprise environment preferred.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

restpythonci/cddockerapiai

Platform: oracle-cloud
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off

Wellness