> Markdown version of [/jobs/ext/1501330-staff-information-security-engineer-threat-defense-automation](https://www.wearedevelopers.com/jobs/ext/1501330-staff-information-security-engineer-threat-defense-automation). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff Information Security Engineer - Threat Defense & Automation

- **Company:** Proofpoint
- **Location:** Draper, UT, United States
- **Salary:** $187,700.0 - $275,275.0
- **Contract:** Permanent contract
- **Skills:** Bash Shell, Cloud Computing Security, Cyber Security, Information Security Management, Intrusion Detection and Prevention, Python (Programming Language), Windows PowerShell, Security Information and Event Management, Scripting, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Security Orchestration, Automation & Response
- **Published:** July 30, 2026
- **Apply:** https://www.techcareers.com/job.asp?id=3336294352&tx=UT5046TYT&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* 12+ years in Incident Response, DFIR, Threat Hunting, or Security Operations.
 * Deep expertise in incident response, threat hunting, and threat intelligence.
 * Strong knowledge of MITRE ATT&CK and adversary TTPs.
 * Experience with SIEM, EDR, SOAR, and cloud security.
 * Scripting experience (Python, PowerShell, or Bash).
 * Strong communication and leadership skills.
 * US Citizen., * Experience building threat hunting or detection programs.
 * Background in threat intelligence or red/purple teaming.
 * Certifications such as GCFA, GCIH, CISSP, CISM, OSCP.

## Description

We're seeking a Staff Information Security Engineer to help lead and evolve our Global Information Security Operation. In this role, you'll shape incident response strategy, push forward advanced threat detection and defense capabilities, and take point on the most complex security investigations across the enterprise.

As a Staff-level engineer, you will operate as a subject matter expert and technical leader, partnering across SOC, Threat Intelligence, Detection Engineering, and Security Engineering to improve Proofpoint's ability to detect, respond to, and proactively hunt advanced threats.

This role includes participation in a 24/7 on-call incident response rotation., * Serve as a Level 3 / Staff escalation point for high-severity incidents.

 * Lead investigations into APTs, ransomware, insider threats, and cloud compromises.
 * Act as incident commander and coordinate response efforts.
 * Participate in 24/7 on-call incident response.
 * Lead threat hunting across endpoint, network, identity, and cloud.
 * Operationalize threat intelligence into detections and response.
 * Design and improve detections across SIEM, EDR, and SOAR.
 * Automate incident triage and response workflows.
 * Drive post-incident reviews and continuous improvement.
 * Mentor team members and influence security strategy.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [MCP doesn’t suck — your agent does](https://www.wearedevelopers.com/videos/100202-mcp-doesn-t-suck-your-agent-does)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)