Senior Phishing Defense Specialist

Petro Ladies Club; Abu Dhabi; Remote; AED 280,000 - 420,000; Full time

Job summary

Petro Ladies Club is seeking aSenior Phishing Defence Specialist to lead our email security program from a fully remote UAE basis. You will own detection, investigation, and response to phishing threats and coordinate with cross‑functional teams to reduce risk and protect financial and operational data.

The role emphasizes hands‑on work with enterprise email security platforms, DMARC/SPF/DKIM, threat hunting, and incident response.

Qualifications

• Mid-level to senior experience in email security and threat detection.
• Hands-on experience with enterprise email platforms and security tools.
• Strong analytical and investigative skills with evidence-based approach.
• Ability to translate phishing threats into practical technical controls.

Responsibilities

• Monitor, identify, and classify suspected phishing emails and threats.
• Analyze email headers, sender data, and authentication results for legitimacy.
• Investigate phishing campaigns, impersonation, and BEC attempts with scope assessment.
• Configure and maintain anti-phishing policies and domain impersonation protections.
• Lead or support incident response, containment, and remediation across mailboxes.

Job description

We're Hiring: Senior Phishing Defence Specialist

Location: United Arab Emirates (Remote)

Employment Type: Full-Time

Experience Level: Mid-Level to Senior

Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through operational excellence, effective risk management, secure technology infrastructure, and collaborative project delivery. Our distributed teams work across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership to support business continuity, protect sensitive information, and maintain reliable digital operations.

As our organization increasingly depends on digital communication, cloud collaboration, remote access, and third-party relationships, defending against phishing and social engineering has become essential to protecting business information and preventing financial, operational, and reputational losses. We value professionals who combine technical expertise, analytical thinking, security awareness, and proactive threat investigation to strengthen organizational resilience against email-based and identity-focused attacks.

The Role

We are seeking an experienced Senior Phishing Defence Specialist to lead and enhance the organization's phishing prevention, detection, investigation, and response capabilities. The successful candidate will be responsible for identifying malicious emails, investigating suspicious links and attachments, detecting impersonation and business email compromise (BEC), improving email security controls, and coordinating responses to phishing-related security incidents.

This role will focus on email threat protection, phishing analysis, malicious URL and attachment investigation, domain and sender authentication, threat intelligence, security awareness, and incident response. The specialist will work closely with Security Operations, Email Security, Identity and Access Management, Infrastructure, Human Resources, Finance, Legal, and other business teams to reduce phishing exposure, protect user accounts, prevent fraudulent transactions, and improve the organization's ability to recognize and respond to social engineering threats.

The ideal candidate will have hands‑on experience with enterprise email security platforms, email authentication standards, phishing investigation tools, identity security controls and security operations processes. The role requires a strong understanding of attacker techniques, an evidence-based approach to threat analysis, and the ability to translate emerging phishing threats into practical technical controls and measurable improvements.

Key Responsibilities 1. Phishing Detection and Email Threat Analysis

• Monitor, identify, investigate, and classify suspected phishing emails, malicious messages, spam campaigns, and other email-based threats.
• Analyze email headers, sender addresses, reply‑to fields, routing information, message metadata, and authentication results to determine message legitimacy.
• Examine suspicious links, embedded URLs, attachments, QR codes, and redirection chains for malicious behavior.
• Identify common phishing indicators, including spoofed domains, misleading display names, lookalike domains, unusual language, suspicious requests, and mismatched sender information.
• Investigate spear‑phishing, whaling, executive impersonation, credential harvesting, payment diversion, and business email compromise attempts.
• Distinguish legitimate business communications from malicious or deceptive messages using technical evidence and contextual analysis.
• Assess the severity, scope, and potential impact of phishing campaigns based on affected users, business functions, and associated attack techniques.
• Correlate email indicators with endpoint alerts, identity logs, network telemetry, DNS activity, web proxy events, and other security signals.
• Identify related messages, recipients, domains, URLs, file hashes, and indicators of compromise across the organization's email environment.
• Maintain clear records of investigation findings, classification decisions, evidence, and recommended response actions.
• Escalate high‑risk or widespread phishing campaigns in accordance with established security incident procedures.

Key Responsibilities 2. Email Security Platform Administration

• Administer, configure, monitor, and optimize enterprise email security and anti‑phishing technologies.
• Maintain security policies for inbound and outbound email filtering, malicious attachment detection, URL inspection, sender reputation, and impersonation protection.
• Support the operation of secure email gateways and cloud‑native email security services.
• Work with platforms such as Microsoft Defender for Office 365, Microsoft Exchange Online Protection, Proofpoint, Mimecast, or comparable enterprise solutions.
• Configure and maintain anti‑phishing policies, spam controls, spoof intelligence, domain impersonation detection, and mailbox protection rules.
• Review detection policies and security exceptions to ensure that legitimate business communications are supported without introducing unnecessary risk.
• Investigate email security configuration weaknesses, policy conflicts, delivery issues, and gaps in threat protection.
• Monitor platform health, detection effectiveness, message processing, quarantine activity, and alert generation.
• Coordinate upgrades, configuration changes, policy deployments, and platform integrations through established change management processes.
• Maintain documentation covering email security architecture, policy configurations, operational procedures, and troubleshooting guidance.
• Evaluate new email defense capabilities and recommend enhancements based on threat trends and organizational requirements.

Key Responsibilities 3. Email Authentication and Domain Protection

• Implement, maintain, and troubleshoot email authentication controls, including Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain‑based Message Authentication, Reporting and Conformance (DMARC).
• Review SPF records, DKIM signing configurations, DMARC policies, and associated DNS settings for accuracy and effectiveness.
• Analyze DMARC reports to identify unauthorized senders, spoofing attempts, misconfigured systems, and legitimate third‑party email services.
• Coordinate with DNS, messaging, infrastructure, and application teams to correct email authentication failures.
• Support the progressive enforcement of DMARC policies, including appropriate evaluation of monitoring, quarantine, and rejection configurations.
• Identify domains and subdomains that may be vulnerable to impersonation, spoofing, or unauthorized email use.
• Monitor lookalike domains, typosquatting, suspicious domain registrations, and other indicators of brand or organizational impersonation.
• Coordinate appropriate investigation and escalation of suspected domain abuse with authorized internal teams and external providers.
• Maintain an inventory of organizational domains, approved email senders, third‑party mail services, and relevant authentication dependencies.
• Recommend improvements to email authentication and domain governance to reduce spoofing and impersonation risks.
• Support periodic reviews of email authentication controls following changes to business applications, vendors, or messaging infrastructure.

Key Responsibilities 4. Phishing Investigation and Incident Response

• Lead or support phishing‑related incident investigations from initial report through containment, eradication, recovery, and lessons learned.
• Determine whether users interacted with malicious messages, opened attachments, visited phishing websites, submitted credentials, or approved unauthorized authentication requests.
• Coordinate message searches, quarantine actions, removal of malicious emails, and other approved remediation measures across affected mailboxes.
• Identify all recipients of a phishing campaign and assess whether the threat has reached additional users or business units.
• Work with endpoint security teams to investigate potential malware execution or compromise resulting from malicious attachments and links.
• Collaborate with Identity and Access Management teams to address compromised credentials, suspicious sign‑ins, session exposure, and unauthorized account activity.
• Coordinate password resets, session revocation, multifactor authentication reviews, and other approved containment measures where necessary.
• Assess potential business email compromise incidents involving fraudulent payment requests, supplier bank detail changes, executive impersonation, or unauthorized financial instructions.
• Work with Finance, Procurement, Commercial, and relevant business owners to verify suspicious payment or supplier‑change requests through approved independent channels.
• Preserve relevant email messages, headers, attachments, URLs, logs, and other evidence in accordance with investigation and evidence‑handling procedures.
• Develop incident timelines and document the attack method, affected users, scope, root cause, containment measures, and remediation outcomes.
• Support post‑incident reviews and translate investigation findings into improvements to email security controls and response playbooks.
• Ensure incident records are complete, traceable, and suitable for management reporting, audit, and authorized investigations.

Key Responsibilities 5. Malicious URL and Attachment Analysis

• Analyze suspicious URLs, web destinations, file attachments, embedded objects, and document‑based threats using approved security tools.
• Inspect URL redirects, domain characteristics, certificate information, hosting infrastructure, and associated threat intelligence.
• Investigate credential‑harvesting pages, fake login portals, malicious QR codes, and other techniques designed to bypass traditional email filtering.