Email Security and Social Engineering Analyst

Job Description Email Security and Social Engineering Analyst

Job Description Email Security and Social Engineering Analyst

Business Area
:
Information Security - Security Operations

Posting Type
:
Internal Applicants

Work Arrangement
:
On-site preferred (Memphis, New Orleans, other sites to be considered)

We are seeking an associate to join the Security Operations team as an Email Security Analyst. This role will help protect the organization, our associates, and our customers by managing email security controls and investigating suspicious messages. The analyst will work extensively in Proofpoint and Outlook, triage reported phishing emails, support incident response, and help improve how we detect and respond to email-based threats.

The ideal candidate brings a healthy sense of paranoia: someone who notices when details do not add up, verifies assumptions, follows evidence, and remains appropriately skeptical without losing sight of business context. Just as important, this associate must communicate clearly and calmly with technical teams, business partners, leaders, and end users.

This position is a great opportunity to be on the front line of threats impacting our associates and customers. You will see firsthand - and help defend against - cybersecurity and social engineering threats while gaining hands-on experience with enterprise email security, phishing response, digital risk protection, threat analysis, incident response, and security operations. You will also partner with teams across the company to investigate issues, contain threats, and protect the organization.

• Use the Proofpoint Secure Email Gateway and related Proofpoint tools to review and manage email traffic, alerts, quarantines, and threat activity.
• Lead day-to-day phishing response by monitoring, triaging, investigating, containing, and documenting suspicious emails reported by associates and customers.
• Address Service Now tickets related to phishing, email security, email delivery, and other assigned security issues within established service-level expectations.
• Troubleshoot email delivery issues by reviewing message tracking, filtering decisions, quarantines, authentication results, policy routes, allow and block controls, and other relevant data.
• Analyze message headers, sender behavior, URLs, attachments, redirects, and message context to determine whether an email is legitimate, suspicious, or malicious.
• Investigate social engineering activity, including phishing, impersonation, business email compromise, credential theft, malicious links, and fraudulent requests.
• Support digital risk protection activities by identifying, reviewing, and escalating external threats such as brand impersonation, fraudulent domains, malicious websites, and other risks targeting the organization, its associates, or its customers.
• Perform Tier 1 phishing triage and escalating confirmed threats or complex investigations as appropriate.
• Use sandboxing, threat intelligence, endpoint, identity, and logging tools to validate findings and determine potential impact.
• Support email authentication and protection controls, including DMARC, SPF, DKIM, policy routes, and email firewall rules.
• Search for related messages, contain threats, remove malicious emails, and support affected-user response actions.
• Support incident response for compromised user accounts and devices, including evidence collection, scoping, containment, escalation, remediation coordination, and documentation.
• Work with Identity, Endpoint, Security Operations, and other response teams to protect affected users, reset or secure access, isolate devices when appropriate, and confirm that threats have been contained.
• Document investigations, evidence, decisions, and actions accurately and consistently.
• Communicate findings and recommended actions to associates in clear, professional, and timely language.
• Partner with Security Operations, Threat Management, Security Engineering, Messaging, Identity, and other teams during investigations and incidents.
• Identify recurring patterns, control gaps, and opportunities to improve phishing…