Senior (L2) Email Security Engineer

Job Description: Senior (L2) Email Security Engineer

Job Summary

The Senior (L2) Email Security Engineer serves as the highest escalation point for complex email security threats and infrastructure engineering. You will own the architecture, optimization, and administration of our global Proofpoint ecosystem. Additionally, you will provide advanced support for Endpoint Protection (EPP/EDR) and Vulnerability Management platforms. This role requires deep technical expertise, proactive threat hunting, and the ability to design resilient security controls to protect enterprise infrastructure.

Key Responsibilities

Primary Focus: Email Security (Proofpoint Expert)

• Architect and Design: Own the engineering, deployment, and configuration of Proofpoint Protection Server (PPS), Target Attack Protection (TAP), and Threat Response Auto-Response (TRAP).
• Advanced Escalations: Handle L3 incident escalations regarding sophisticated phishing, business email compromise (BEC), spoofing, and malware delivery.
• Mail Flow Management: Manage MX records, routing policies, and deep configuration of SPF, DKIM, and DMARC protocols.
• Analyze emails: Review quarantined items, headers, and attachments for phishing attacks.
• Policy Optimization: Author, test, and tune complex custom rules, content filters, and Data Loss Prevention (DLP) policies.
• Vendor Management: Interface directly with Proofpoint technical support and product teams to resolve root-cause platform bugs.

Secondary Focus: Endpoint Security (EPP & EDR)

• Agent Deployment: Oversee the health, policy enforcement, and deployment of enterprise EPP/EDR agents (e.g., CrowdStrike, Symantec, TrendMicros ).
• Threat Hunting: Conduct proactive threat hunting across endpoint telemetry based on Proofpoint email threat indicators.
• Incident Response: Lead advanced containment, isolation, and remediation efforts for compromised endpoints.

Secondary Focus: Vulnerability Management

• Assessment Ownership: Configure and maintain enterprise vulnerability scanning schedules (e.g., Tenable, Qualys, or Rapid7).
• Risk Prioritization: Analyze scan results to prioritize vulnerabilities based on exploitability, threat intelligence, and business context.
• Remediation Collaboration: Partner with Infrastructure and DevOps teams to track patching cycles and validate remediations.

Technical Requirements

Required Core Skills

• Proofpoint Stack: Deep knowledge of PPS, TAP, TRAP, Email Fraud Defense (EFD), and Proofpoint Enterprise DLP.
• Email Infrastructure: Advanced understanding of SMTP topology, TLS encryption, DNS, and Microsoft 365 / Google Workspace hybrid environments.
• EDR Platforms: Experience managing enterprise endpoint platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.
• Vulnerability Scanners: Operational mastery of Primary Qualys Guard, Good to have experience in Tenable.io/Nessus, , or Rapid7 InsightVM.

Preferred Experience & Certifications

• Experience: 8+ years in dedicated Cyber Security Engineering, with at least 3 years operating at an L3/Senior level.
• Certifications: Proofpoint Certified System Administrator (PCSA) or Proofpoint Certified Security Engineer (PCSE).