Senior Full Stack Software Engineer, Threat Intelligence Services

Proofpoint; Phoenix (AZ); On-site; USD 124,000 - 244,000; Full time

Benefits offered by this job

Competitive compensation

Comprehensive benefits

Career success on your terms

Flexible work environment

Annual wellness and community outreach

Recognition for contributions

Global collaboration

Job summary

Proofpoint is hiring a software engineer to build and operate a threat intelligence platform. You will work on AWS-backed services, APIs, and a React/Node.js front end to deliver dashboards, reports, and detection tooling.

You will partner with analysts to automate repetitive tasks, maintain a headless CMS portal, and ensure security and reliability across the stack. This role expects 2–5 years of professional experience and strong Python proficiency.

Qualifications

• 2-5 years of professional software engineering experience, able to operate production systems with minimal supervision.
• Hands-on AWS administration including EC2, Lambda, storage, networking, monitoring, and troubleshooting.
• API development and integration experience; AWS API Gateway preferred.
• Front-end development with React and Node.js, ideally including Fuse (or a comparable React framework).
• Proficiency in Python and SQL with PostgreSQL.
• Ability to learn new systems quickly and work independently across the full stack.

Responsibilities

• Administer and troubleshoot the team's AWS environment including EC2, Lambda, storage, networking, monitoring, and deployment pipelines.
• Design and build APIs and integrations (AWS API Gateway) that wire threat-intel platforms, third-party feeds, and LLM services.
• Develop and deploy the web front-ends analysts use to generate and deliver intelligence (React/Node.js; Fuse), including dashboards and report generators.
• Maintain and enhance the headless CMS-based portal, its PostgreSQL/Elastic Search infrastructure, and micro-frontend (Fuse/React).
• Write Python services (FastAPI) for data processing, report and detection-rule generation, and workflow automation.
• Model and query data across PostgreSQL and Elastic Search and support CMS-backed content workflows.
• Collaborate with analysts to automate manual tasks into maintainable products.
• Ensure platform reliability, observability, QA, security, and thorough documentation.

Skills

Python

JavaScript (React/JSX)

AWS

API development

PostgreSQL

Docker

Terraform

Git / CI/CD

FastAPI

Data modeling

Tools

Terraform

Docker

dotCMS

Git

CI/CD pipelines

Job description

About Us

Proofpoint is a global leader in human- and agent-centric cybersecurity. We protect how people, data, and AI agents connect across email, cloud, and collaboration tools. Over 80 of the Fortune 100, 10,000 large enterprises, and millions of smaller organizations trust Proofpoint to stop threats, prevent data loss, and build resilience across their people and AI workflows. Our mission is simple safeguard the digital world and empower people to work securely and confidently. Join us in our pursuit to defend data and protect people.

How We Work

• Bold in how we dream and innovate
• Responsive to feedback, challenges and opportunities
• Accountable for results and best in class outcomes
• Visionary in future focused problem-solving
• Exceptional in execution and impact

The Role

The Threat Intelligence Services (TIS) team turns Proofpoint's threat data and telemetry into intelligence products for customers through reporting, analytics, detection content, and live briefings. Behind that work is a fast-growing suite of internal web applications, data integrations, automation, cloud infrastructure, and a customer-facing CMS. We are hiring a software engineer to build and operate that platform.

Your day-to-day

• Administer and troubleshoot the team's AWS environment, including but not limited to EC2, Lambda, storage, networking (VPC, DNS/Route 53, transit gateway, security groups), monitoring, and deployment pipelines.
• Design and build APIs and integrations (AWS API Gateway) that wire internal threat-intel platforms, third-party threat feeds, and LLM services into the tooling suite.
• Develop and deploy the web front-ends analysts use to generate and deliver intelligence (React / Node.js; Fuse), including dashboards, report/deck generators, and detection tooling.
• Maintain and develop enhancements to the headless CMS-based customer threat intel portal, its underlying database (PostgreSQL and Elastic Search) infrastructure, and micro-frontend (Fuse/React)
• Write Python services (FastAPI) for data processing, report and detection-rule generation, and workflow automation.
• Model and query data across PostgreSQL and Elastic Search and support headless-CMS-backed content workflows.
• Partner directly with analysts to identify manual, repetitive intelligence tasks and turn them into automated, maintainable products.
• Keep the platform secure, observable, and well-documented. You own reliability, troubleshooting, QA, and security for what you ship.

Tech stack

• Languages Python, JavaScript (React/JSX)
• Cloud AWS — Lambda, API Gateway, IAM, Secrets Manager, CloudWatch, ALB/VPC
• IaC Terraform / Terramake
• CMS dotCMS
• API/Auth REST APIs, custom authorizers, JWT / API keys
• Domain Threat intelligence / IOC feeds (STIX, MISP, CSV)
• Tooling Git, CI/CD, AWS CLI

What You Bring To The Team (required)

• 2-5 years of professional software engineering experience and are comfortable delivering and operating production systems with minimal supervision. We are open to candidates around the 2-year mark, but this is not an entry-level role.
• Hands-on AWS administration EC2, Lambda, storage, networking, monitoring, and troubleshooting.
• API development and integration experience; AWS API Gateway preferred.
• Front-end development with React and Node.js, ideally including Fuse (or a comparable React application framework).
• Proficiency in Python.
• SQL and relational database experience, preferably PostgreSQL.
• Ability to learn new systems and domains quickly and work independently across the full stack infrastructure, backend, and front-end.

Nice to have

• Micro front-end development and deployment.
• ElasticSearch.
• Experience with headless CMSs (e.g., dotCMS, Payload, Strapi, or Contentful).
• MCP (Model Context Protocol) server development.
• Containerization (Docker), CI/CD, and infrastructure-as-code.
• Familiarity with cybersecurity or threat-intelligence concepts as you'll work shoulder-to-shoulder with analysts, so curiosity about the domain goes a long way (you don't need to be an analyst yourself).

Why Proofpoint?

• Competitive compensation
• Comprehensive benefits
• Career success on your terms
• Flexible work environment
• Annual wellness and community outreach days
• Always on recognition for your contributions
• Global collaboration and networking opportunities

Our Culture

Our culture is rooted in values that inspire belonging, empower purpose and drive success-every day, for everyone. We encourage applications from individuals of all backgrounds, experiences, and perspectives. If you need accommodation during the application or interview process, please reach out to [e-mail].

Base Pay Ranges

SF Bay Area, New York City Metro Area

Base Pay Range 166,500.00 - 244,200.00 USD

California (excludes SF Bay Area), Colorado, Connecticut, Illinois, Washington DC Metro, Maryland, Massachusetts, New Jersey, Texas, Washington, Virginia, and Alaska

Base Pay Range 136,200.00 - 199,760.00 USD

All other cities and states excluding those listed above

Base Pay Range 124,100.00 - 182,050.00 USD