This role pays more than
88%
of similar roles. Most pay
$152,150–$214,428
— the shaded band above.
At the midpoint, this role pays about
$231k
versus about
$183k
for comparable roles.
Based on 240 similar postings.
Employer
About Proofpoint
Proofpoint is a cybersecurity company specializing in email security, threat protection, data loss prevention, and compliance. Privately held by Thoma Bravo since 2021, it serves over 500,000 organizations including 87 of the Fortune 100.
Proofpoint currently has
11 open roles
on FindRole.
Listed pay typically runs
$166,500–$244,200
across 7 roles with salary data.
Staff Information Security Engineer - Threat Defense & Automation joins the Global Information Security Operation team as a technical leader and subject matter expert. This role focuses on shaping incident response strategy, advancing threat detection capabilities, and leading complex investigations into APTs, ransomware, insider threats, and cloud compromises. The engineer will act as an incident commander, perform proactive threat hunting across endpoint, network, identity, and cloud environments, and automate triage workflows. Key responsibilities include operationalizing threat intelligence into detections and mentoring team members. Required skills include deep expertise in DFIR and the MITRE ATT&CK framework, along with proficiency in SIEM, EDR, and SOAR tools. Candidates must possess scripting experience in Python, PowerShell, or Bash to improve security posture and drive continuous improvement through post-incident reviews and automated response systems.
Serve as a Level 3 escalation point for high-severity security incidents.
Lead investigations into APTs, ransomware, insider threats, and cloud compromises.
Act as an incident commander to coordinate response efforts across the enterprise.
Participate in a 24/7 on-call rotation for incident response.
Lead threat hunting across endpoint, network, identity, and cloud environments.
Operationalize threat intelligence into actionable detections and response strategies.
Design and improve detection capabilities across SIEM, EDR, and SOAR platforms.
Automate incident triage and response workflows to improve operational efficiency.
What we're looking for
Must be a US Citizen.
12+ years of experience in Incident Response, DFIR, Threat Hunting, or Security Operations.
Deep expertise in incident response, threat hunting, and threat intelligence.
Strong knowledge of MITRE ATT&CK and adversary TTPs.
Experience with SIEM, EDR, SOAR, and cloud security.
Scripting experience in Python, PowerShell, or Bash.
Strong communication and leadership skills.
Experience building threat hunting or detection programs (preferred); background in threat intelligence or red/purple teaming (preferred); certifications such as GCFA, GCIH, CISSP, CISM, OSCP (preferred).