SPAM Data Engineer

Proofpoint•Sunnyvale, CA

About The Position

About Us: Proofpoint is a global leader in human- and agent-centric cybersecurity. We protect how people, data, and AI agents connect across email, cloud, and collaboration tools. Over 80 of the Fortune 100, 10,000 large enterprises, and millions of smaller organizations trust Proofpoint to stop threats, prevent data loss, and build resilience across their people and AI workflows. Our mission is simple: safeguard the digital world and empower people to work securely and confidently. Join us in our pursuit to defend data and protect people. How We Work: At Proofpoint you’ll be part of a global team that breaks barriers to redefine cybersecurity guided by our BRAVE core values: Bold in how we dream and innovate Responsive to feedback, challenges and opportunities Accountable for results and best in class outcomes Visionary in future focused problem-solving Exceptional in execution and impact The Role This team is the front line of defence for protecting our customers from email messaging abuse. We are looking for a creative thinking, enthusiastic individual to join a diverse group of people who are passionate about defending the world from this growing threat. We are competing against very active, devious, and motivated adversaries who send trillions of spam and malware messages every year! If you are interested in helping us achieve our goal of ridding the world of email borne threats, then we'd definitely like to talk to you! Our team is a highly collaborative global community of like-minded people, where you are encouraged to be creative, expand your skills, and support others in doing the same. We believe in maintaining a strong work-life balance (a happy team is a productive team!), which has helped us develop a close community who look after each other and are always willing to offer guidance and assistance. Your day-to-day Member of a creative, enthusiastic, and geographically distributed team (in a 24/7/365 "follow the sun" model) that is responsible for identifying, parameterizing, and responding quickly to spam/Phishing/Malware/BEC (Email Fraud) attacks levied against some of the world's largest organizations Analyze misclassified email messages, URLs, and attachments (spam, malware, phishing, and legitimate) to make updates to detection technologies and correct their classifications. Perform deep analyses of email headers, structures, and attachments to identify novel threat features, and develop new rules/methods to detect them. Research into new trends and creation of pro-active detection to stop new threats before they start Contribute to the development of new tools and automation to aid in front line analysis, and to identify the latest threats Work with the team to come up with new and novel ways to detect threats Take on more complex customer false negative or false positive cases escalated by other analysts in the team that require more in-depth investigation and analysis Work on internal escalation tickets created by field teams for customers experiencing more complex or systemic recurring issues that have not been solved through usual means, collaborating with other engineering teams where necessary to find the best solutions On-call work - that means responding to high priority alerts sent by our threat monitoring system, and periodic monitoring of essential systems. You would be expected to be on call at times during your shift Help us define the landscape, prevalence, and evolution of messaging abuse, threats, and attacks by participating in future requirements definition discussions of our products

Requirements

Strong analytical and creative problem-solving skills
Proficient oral and written communications skills. Collaborates well in a team environment. Able to communicate complex technical concepts to customers in an accessible manner.
Familiarity with using the Linux command line, and tools for manipulating and extracting content from text files
Good knowledge of regular expressions
Familiarity with how mail delivery works, including SMTP
General curiosity about the headers and structure of email messages
Willingness to interact with customers through our web-based ticketing system to help resolve their issues
Ability to work independently but also to collaborate with worldwide, remote teams
Positive, friendly attitude that enjoys problem solving
BSc or equivalent in IT related subject, or equivalent technical experience
U.S. Citizenship required

Nice To Haves

Experience in a data science or similar role ( a plus)
Experience with signature-based detections such as Clam, Yara, or similar an advantage
Familiarity with a scripting language such as Python or Perl an advantage (a Big Plus)

Responsibilities

Member of a creative, enthusiastic, and geographically distributed team (in a 24/7/365 "follow the sun" model) that is responsible for identifying, parameterizing, and responding quickly to spam/Phishing/Malware/BEC (Email Fraud) attacks levied against some of the world's largest organizations
Analyze misclassified email messages, URLs, and attachments (spam, malware, phishing, and legitimate) to make updates to detection technologies and correct their classifications.
Perform deep analyses of email headers, structures, and attachments to identify novel threat features, and develop new rules/methods to detect them.
Research into new trends and creation of pro-active detection to stop new threats before they start
Contribute to the development of new tools and automation to aid in front line analysis, and to identify the latest threats
Work with the team to come up with new and novel ways to detect threats
Take on more complex customer false negative or false positive cases escalated by other analysts in the team that require more in-depth investigation and analysis
Work on internal escalation tickets created by field teams for customers experiencing more complex or systemic recurring issues that have not been solved through usual means, collaborating with other engineering teams where necessary to find the best solutions
On-call work - that means responding to high priority alerts sent by our threat monitoring system, and periodic monitoring of essential systems. You would be expected to be on call at times during your shift
Help us define the landscape, prevalence, and evolution of messaging abuse, threats, and attacks by participating in future requirements definition discussions of our products