> Markdown version of [/jobs/ext/2567311-proofpoint-email-security-analyst](https://www.wearedevelopers.com/jobs/ext/2567311-proofpoint-email-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Proofpoint Email Security Analyst - **Company:** Yoh Services LLC - **Location:** McKinney, TX, United States - **Salary:** $94,640.0 - $135,200.0 - **Contract:** Temporary to permanent - **Skills:** Microsoft Windows, Domainkeys Identified Mail, Domain-Based Message Authentication Reporting and Conformance (DMARC), Identity and Access Management, Routing, Phishing, Sender Policy Framework (SPF) - **Published:** August 16, 2026 - **Apply:** https://diversityjobs.com/main/sendform/8/8/28176/1/17972891?backUrl=%2Fcareer%2F17972891%2FProofpoint-Email-Security-Analyst-Texas-Mckinney ## About the Role * Demonstrated experience using Proofpoint in an operational security role (monitoring, quarantine triage, investigations, policy tuning). * Strong knowledge of phishing/BEC tradecraft and email analysis (headers, routing, URLs/attachments, domain reputation). * Working understanding of Microsoft 365 / Exchange Online concepts and email authentication (SPF/DKIM/DMARC). * Strong analytical skills, attention to detail, sound judgment, and clear communication with both technical and non-technical users. * Ability to document work cleanly and operate effectively in an alert-driven environment. ## Description * Monitor Proofpoint dashboards, alerts, quarantine queues, digest activity, abuse mailboxes, and user-reported phishing submissions. * Triage and investigate email threats including phishing, business email compromise (BEC), impersonation, malware delivery, spam, and fraudulent communications. * Determine risk using email artifacts such as headers, sender reputation, authentication results (SPF/DKIM/DMARC), URLs, attachments, domains, and message content. * Use Proofpoint search / message tracking capabilities to identify campaign scope and locate malicious messages across impacted mailboxes. * Execute containment actions in Proofpoint: block/deny-list malicious senders, domains, URLs, and other indicators; manage allow/deny logic where appropriate. * Drive remediation and takedown actions (e.g., message removal guidance, user notification, escalation to IR/SOC when needed). * Administer and continuously tune Proofpoint policies, detection rules, and protection controls to improve efficacy and reduce false positives. * Review quarantined messages and determine whether messages should be released, blocked, or escalated, documenting rationale and outcomes. * Maintain and refine block lists, allow lists, and exception workflows with strong change control and documentation. * Monitor and assist with SPF, DKIM, and DMARC posture to reduce spoofing/impersonation risk. * Identify misconfigurations and coordinate corrective actions with domain owners, Microsoft 365 administrators, and relevant business stakeholders. * Support investigations involving account compromise, suspicious mailbox rules/forwarding, unusual email access patterns, and suspicious outbound activity. * Coordinate with SOC, IAM, Incident Response, Microsoft 365, Legal, HR, and business leaders during sensitive investigations. * Document investigation steps, findings, remediation actions, recurring attack patterns, and lessons learned. * Create and maintain SOPs and response playbooks for Proofpoint-driven workflows (triage, quarantine review, campaign response, indicator blocking). * Track and report email-security metrics: message volume, blocked threats, phishing trends, user reporting rates, false positives, remediation SLAs, and emerging TTPs. * Identify opportunities to automate repetitive tasks across investigation, containment, and reporting. * Support email-security projects such as Proofpoint enhancements, platform upgrades, policy changes, onboarding new domains/business units, and M&A-related integration. ## Related Videos - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Creating a routing app with Google Maps API from scratch](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) - [Fake or News: Translating Dog Barks, Notepad Gets an Upgrade and Michelin-Star Robots - Paul Tregoing](https://www.wearedevelopers.com/videos/1802-fake-or-news-translating-dog-barks-notepad-gets-an-upgrade-and-michelin-star-robots-paul-tregoing) - [MFA? Game over! Watch your protection collapse – live](https://www.wearedevelopers.com/videos/100322-mfa-game-over-watch-your-protection-collapse-live) - [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering) - [No More Post-its: Boost your login security with APIs](https://www.wearedevelopers.com/videos/1043-no-more-post-its-boost-your-login-security-with-apis) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems) - [Dev Digest 187: Build Agents, pick MCPs and prove you're not a robot!](https://www.wearedevelopers.com/magazine/633-dev-digest-187-build-agents-pick-mcps-and-prove-you-re-not-a-robot)