[Remote] Staff Security Engineer, Threat Defense & Automation

Note: The job is a remote job and is open to candidates in USA. Proofpoint is a global leader in human- and agent-centric cybersecurity, dedicated to protecting organizations from cyber threats. The role involves managing and responding to security incidents, acting as an escalation point for the 24/7 Security Operations Center, and enhancing security incident response capabilities through automation and collaboration. Responsibilities • Act as the Level 3 escalation point for high-severity security incidents within the global 24/7 SOC • Lead complex investigations into advanced cyber threats, including malware outbreaks, targeted attacks, and persistent threats • Provide expert-level guidance on containment, mitigation, and remediation strategies • Proactively hunt for hidden threats within enterprise networks using threat intelligence and behavioral analytics • Develop and refine threat detection rules to improve SOC visibility • Assess emerging threats and provide actionable recommendations to enhance security posture • Design and implement automated workflows to enhance security event triage and response • Leverage SOAR (Security Orchestration, Automation, and Response) platforms to streamline incident response • Work with SIEM (Security Information and Event Management) tools to optimize log ingestion and alerting mechanisms • Collaborate with security architects and engineers to enhance detection and response capabilities • Perform root cause analysis on security incidents and recommend improvements to security controls • Stay updated on industry best practices and evolving attack techniques to ensure effective defenses Skills • 12 yrs + hands-on experience in Cybersecurity Incident Response or Security Operations • Must be a US Citizen • Strong background in SOC operations, SIEM, threat intelligence, and digital forensics. Expertise in investigating malware, phishing, web attacks, insider threats, and advanced persistent threats (APTs) • Experience working with security automation and orchestration tools (SOAR) • Familiarity with scripting languages such as Python, PowerShell, or Bash for security automation • Strong understanding of MITRE ATT&CK framework, TTPs (Tactics, Techniques, and Procedures), and cyber kill chain • Hands-on experience with cloud security (AWS, Azure, GCP) is a plus • Certifications such as GCIH, GCFA, CISSP, CISM, or OSCP are highly desirable • Ability to work in a fast-paced, global environment and collaborate with cross-functional teams Benefits • Competitive compensation • Comprehensive benefits • Career success on your terms • Flexible work environment • Annual wellness and community outreach days • Always on recognition for your contributions • Global collaboration and networking opportunities • Flexible time off • A comprehensive well-being program with two paid Wellbeing Days and two paid Volunteer Days per year • A three-week Work from Anywhere option Company Overview • Proofpoint provides cloud-based email security, e-discovery, and compliance solutions for companies to protect sensitive business data. It was founded in 2002, and is headquartered in Sunnyvale, California, USA, with a workforce of 1001-5000 employees. Its website is Apply tot his job