Cybersecurity Ops Technologist I (Email Security)

Cybersecurity operations is responsible for the identification, protection, detection, response and disruption of cybersecurity events across Travelers through critical analysis, threat intelligence gathering, and agile cybersecurity techniques to assess, support, and resolve cyber incidents. Within Cybersecurity Operations, our Email Security team protects a complex messaging environment with a hybrid architecture spanning more than 50,000 mailboxes.

As a Cybersecurity Ops Technologist I on this team, you will own the day-to-day administration, configuration, and optimization of our Proofpoint infrastructure, acting as the subject-matter authority on email threat prevention, authentication, and mail flow across Travelers. This is a hands-on technical operations role for someone who has deep, product-level expertise in enterprise email security and is ready to apply that expertise at scale.

What Will You Do?

- Administer and optimize our enterprise Proofpoint deployment - including Targeted Attack Protection (TAP), Threat Response Auto-Pull (TRAP), Secure Email Relay, Adaptive Email Security/Email DLP, Email Isolation, and Email Fraud Defense - to protect a hybrid M365/on-premises Exchange environment. - Design, configure, and maintain secure email gateway rulesets, mail flow policies, and quarantine management strategies, balancing threat containment against business continuity across 50,000+ mailboxes. - Own DKIM, SPF, and DMARC strategy end-to-end: authoring and maintaining records, tuning alignment and enforcement policies, and troubleshooting authentication failures across multiple sending domains and third-party senders. - Manage and troubleshoot complex mail relay and connector configurations spanning Microsoft 365 and on-premises Exchange, ensuring reliable mail flow through the Proofpoint gateway. - Analyze internal and external threat intelligence and TAP telemetry to identify emerging phishing, BEC, and malware campaigns targeting the organization, and tune detection rules and policies in response. - Partner with the SOC to build and refine automated response playbooks for email-borne threats, including TRAP-driven message remediation. - Serve as the email security escalation point of contact for operational inquiries and troubleshooting, providing technical analysis on message trace, header forensics, and delivery/authentication failures. - Evaluate and integrate complementary controls such as M365 Defender for Office 365 (Safe Links, Safe Attachments, Threat Explorer) to strengthen a layered email defense strategy. - Communicate email threat trends, platform health, and risk posture clearly to security leadership and business stakeholders. - Perform other duties as assigned.

- Degree or Certificate in Cybersecurity, Computer Science, or related field. - 3+ years of dedicated email security engineering experience, including substantial hands-on administration of the Proofpoint platform (TAP, TRAP, Secure Email/Secure Email Relay, Adaptive Email Security, Email Isolation, Email Fraud Defense, CLEAR) within a large enterprise deployment - strongly preferred for this role. - Alternatively, multiple years of comparable, production-level depth administering another leading secure email gateway platform (e.g., Mimecast, Cisco Secure Email/IronPort, Microsoft Defender for Office 365, Abnormal Security, Barracuda), with demonstrated command of secure email gateway architecture and policy management at scale. - Proven experience configuring and managing quarantine policies, end-user digest and release workflows, and gateway rulesets in a high-volume mail environment. - Deep working knowledge of DKIM, SPF, and DMARC; able to independently design authentication strategy, diagnose alignment/enforcement failures, and manage third-party sender exceptions. - Solid understanding of email relay architecture, MX/connector design, and mail flow troubleshooting in a hybrid Microsoft 365 and on-premises Exchange environment. - Experience working within an Email Security group or an email-focused response function of a SOC, with familiarity in incident handling methodologies as applied to phishing, BEC, and email-delivered malware. - Understanding of M365 Defender for Office 365 and how it complements a Proofpoint-led defense-in-depth strategy is a plus. - Ability to translate technical email threat findings into clear risk insights for both technical and non-technical stakeholders.

- Bachelor's degree or its equivalent in work experience. - 2 years of experience working in a Technology related field or role.