Email Hygiene Analyst – Cybersecurity

The Email Hygiene Analyst is responsible for protecting the organization’s email environment by monitoring, analyzing, and responding to email-based threats, including phishing, business email compromise, malware, spam, impersonation, and fraudulent communications. This role operates within the Cybersecurity team and manages email security technologies such as Proofpoint and Abnormal Security to identify threats, investigate suspicious messages, and reduce organizational risk.

Key responsibilities include:

Monitor email security platforms, alerts, quarantines, abuse mailboxes, and user-reported phishing submissions. Investigate suspected phishing, business email compromise, malware, spam, impersonation, and account takeover activity. Analyze email headers, sender reputation, authentication results, URLs, attachments, domains, and message content to determine risk. Search for and remediate malicious messages across affected user mailboxes. Block malicious senders, domains, URLs, attachments, and other indicators of compromise.

Administer and tune Proofpoint, Abnormal Security, and related email protection policies to improve detection while minimizing false positives. Review quarantined messages and determine whether messages should be released, blocked, or escalated. Investigate user-reported phishing messages and provide timely disposition and feedback. Support phishing simulations, security awareness initiatives, and targeted education for users affected by email threats. Monitor SPF, DKIM, DMARC, and other email authentication controls to identify spoofing risks and configuration issues.

Assist with investigations involving compromised accounts, suspicious forwarding rules, unusual mailbox activity, and unauthorized email access. Coordinate with the Security Operations Center, Identity and Access Management, Incident Response, Microsoft 365, Legal, Human Resources, and other business teams during investigations. Document investigation findings, remediation actions, recurring attack patterns, and lessons learned. Create and maintain standard operating procedures, response playbooks, block lists, allow lists, and email security documentation.

Track email security metrics, including message volume, blocked threats, phishing activity, user reporting rates, false positives, remediation actions, and emerging attack trends. Identify opportunities to automate repetitive investigation, containment, and reporting activities. Support email security projects, platform upgrades, policy changes, mergers and acquisitions, and onboarding of new domains or business units. Stay informed of emerging email attack techniques and recommend improvements to strengthen the organization’s email security posture.

• Monitor email security platforms, alerts, quarantines, abuse mailboxes, and user-reported phishing submissions.
• Investigate suspected phishing, business email compromise, malware, spam, impersonation, and account takeover activity.
• Analyze email headers, sender reputation, authentication results, URLs, attachments, domains, and message content to determine risk.
• Search for and remediate malicious messages across affected user mailboxes.
• Block malicious senders, domains, URLs, attachments, and other indicators of compromise.
• Administer and tune Proofpoint, Abnormal Security, and related email protection policies to improve detection while minimizing false positives.
• Review quarantined messages and determine whether messages should be released, blocked, or escalated.
• Investigate user-reported phishing messages and provide timely disposition and feedback.
• Support phishing simulations, security awareness initiatives, and targeted education for users affected by email threats.
• Monitor SPF,…