Email Security (MDE & Proofpoint)

JD:

Role Overview As an L3/SME (Subject Matter Expert) in Email Security, Resource is expected to lead the architecture, configuration, and continuous optimisation of the enterprise email defence ecosystem. This senior role requires deep expertise in mitigating advanced, evolving email-borne threats. You will serve as the ultimate escalation point for complex incidents, drive security automation, and ensure seamless mail delivery without compromising the organization's security posture.

Key Responsibilities 1. Architecture & Policy Tuning

• Gateway Management: Deploy, configure, and optimize Proofpoint Enterprise Protection and Microsoft Defender for Office 365 (MDO) to guard against phishing, malware, and spam.
• Email Authentication: Lead the implementation, management, and troubleshooting of SPF, DKIM, and DMARC policies.
• Rule Engineering: Create and tune targeted security policies, custom filters, and quarantine workflows to reduce false positives and block zero-day attacks. 2.

Incident Response & Threat Hunting

• Tier 3 Escalations: Act as the final escalation point for the SOC and Level 2 engineers for complex delivery, routing, and security evasion issues.
• Threat Hunting: Proactively analyze email traffic patterns and log data to identify undetected malicious campaigns or compromised internal accounts.
• Incident Management: Lead the response and provide Root Cause Analysis (RCA) for high-impact email security incidents. 3.

Data Protection & Compliance

• DLP & Encryption: Design and tune Data Loss Prevention (DLP) policies to detect and protect PII, financial information, and regulated data traversing email channels.
• Compliance Alignment: Ensure email security configurations comply with internal governance and relevant regulatory frameworks. 4.

Operations & System Administration

• Mail Routing: Troubleshoot inbound/outbound email delays, mail routing issues, and MX record discrepancies.
• Threat Intelligence: Integrate threat intelligence feeds with Proofpoint and MDO to automate blocking and detection capabilities.
• Reporting: Generate and present regular operational metrics (malware blocks, BEC attempts, spam rates) to stakeholders.