Security Solution Analyst II

Overview

About Us Proofpoint is a global leader in human- and agent-centric cybersecurity. We protect how people, data, and AI agents connect across email, cloud, and collaboration tools. Our mission is to safeguard the digital world and empower people to work securely and confidently. Join us in our pursuit to defend data and protect people.

Proofpoint is a global leader in human- and agent-centric cybersecurity. We protect how people, data, and AI agents connect across email, cloud, and collaboration tools. Over 80 of the Fortune 100, 10,000 large enterprises, and millions of smaller organizations trust Proofpoint to stop threats, prevent data loss, and build resilience across their people and AI workflows.

The Security Solution Analyst II will be responsible for overseeing escalations from L1 analysts and customers, coordinating rapid response for high-severity incidents, and continuously improving detection logic, playbooks, and the AI agent’s policies to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). This role involves guiding AI agents, enforcing guardrails, adjudicating complex decisions, and ensuring timely, high-quality incident handling.

You will collaborate closely with Threat Intel, Services, and Customer Success teams to orchestrate safe, explainable, and measurable AI-led outcomes that protect client environments  may assist with all alerts generated by Proofpoint’s TRAP, CTR solutions, and Security Incident Event Management (SIEM), as well as other Proofpoint products as needed. You will be responsible for building and maintaining escalation workflows and providing feedback on requests.

This includes participation in annual information and network security training and acceptance of spot checks on an ad hoc basis to guarantee ongoing ISMS improvement. Each member of our team must understand the importance of the ISMS and the handling of client data. This role is shift-based US Eastern Time, 9am–6pm (weekends may be required).

Your day-to-day

• Monitoring and improving AI agents, enforcing guardrails, and adjudicating complex decisions
• Training and mentoring of junior analysts
• Oversee escalations from L1 analysts and customers; coordinate rapid response for high-severity incidents
• Assisting with L1 triage as needed
• Building and maintaining escalation workflows and providing feedback on request
• Provide feedback recommendations to the Client Service Manager
• Presentation of reports and advanced analytics findings when required
• Attendance at routine client meetings and prep meetings for Proofpoint clients
• Overall responsibility for non-engineering client requests
• Assist in identifying opportunities for new alarm policies
• Maintenance of runbooks and Proofpoint documentation (alarm workflows, escalation procedures, team details, client knowledge base)

• 2+ years in L2 supervision or incident command
• Experience with automation/SOAR workflows and policy-based approvals for response actions
• Demonstrated ability to review and improve AI-driven detections or automated playbooks; comfort with explainability, guardrails, and risk-based decisions
• Familiarity with agentic AI concepts (tool-use policies, action confidence, multi-agent orchestration, reward signals) and RAG pipelines for security context
• Knowledge of phishing technology and functions of security tools that protect/prevent end users against them
• Knowledge of SIEM technology and functions of security tools
• Experience interpreting, tuning, searching, and manipulating data within SIEM
• Experience interpreting, searching, and understanding the structure of an email
• Ability to demonstrate understanding of what a phishing email is, how to spot it, and the ramification if not stopped
• Knowledge or experience utilizing the Cyber Kill Chain, Diamond Model or other appropriate models
• Experience in gathering and managing threat intelligence
• Ability to present a recommended remediation strategy to the client in professional format
• Basic knowledge of cybersecurity threats and the ability to explain their impact to a user/company
• Windows administration experience;
  Security+ certification is a plus

At Proofpoint, we…