Senior Cyber Threat Defense & 24/7 SOC Engineer

Segment (Twilio); Draper (UT); On-site; USD 110,000 - 159,720; Full time

Benefits offered by this job

Competitive compensation

Comprehensive benefits

Flexible work environment

Wellbeing program

Job summary

Proofpoint in Draper, UT seeks an experienced Senior Cyber Threat Defense - Security Operations Engineer to join the 24/7 SOC. You will own Level 3 escalation for high-severity incidents, lead investigations, and coordinate with Legal, Privacy, and IT to contain and recover from threats.

You will drive threat hunting, detection engineering, and automation, building rules and playbooks, leveraging MITRE ATT&CK, STRIDE, and cloud security across AWS/Azure/GCP.

Qualifications

• Eight or more years of hands-on cybersecurity incident response, threat detection, threat hunting, or security operations.
• U.S. citizenship.
• Demonstrated experience leading major incidents and serving as the final technical escalation point for complex or high-severity security events.
• Strong knowledge of SOC operations, SIEM, SOAR, EDR/XDR, threat intelligence, digital forensics, and security monitoring.
• Hands-on experience with SOAR platforms, APIs, and scripting languages such as Python, PowerShell, or Bash.

Responsibilities

• Incident Response: Lead Level 3 escalation for high-severity incidents within the 24/7 SOC and coordinate containment and remediation.
• Threat Hunting & Detection: Develop and tune detection rules, hunting queries, and response use cases.
• Automation: Define and implement automation for alert enrichment, triage, and remediation using scripts and SOAR.
• Emerging Capabilities: Support AI-enabled investigation and AI DLP capabilities.
• Continuous Improvement: Drive improvements to security controls, telemetry, and incident standards.

Skills

Incident response

Threat hunting

Threat modeling

Scripting (Python/PowerShell/Bash)

MITRE ATT&CK

Cloud security

SOC operations

Executive communication

Tools

SOAR platforms

APIs

Python

PowerShell

Bash

SIEM

EDR/XDR

Job description

Proofpoint in Draper, UT seeks an experienced Senior Cyber Threat Defense - Security Operations Engineer to join the 24/7 SOC. You will own Level 3 escalation for high-severity incidents, lead investigations, and coordinate with Legal, Privacy, and IT to contain and recover from threats.

You will drive threat hunting, detection engineering, and automation, building rules and playbooks, leveraging MITRE ATT&CK, STRIDE, and cloud security across AWS/Azure/GCP.