Staff Information Security Engineer - Threat Defense & Automation at Proofpoint
Draper, UT
$137,000–$275,275from the description
Jul 27, 2026
Draper, UT
Jul 29, 2026
What this job asks for AI summary
A senior-level security operations role at a major cybersecurity vendor, focused on leading complex incident response investigations, threat hunting, and detection engineering across endpoint, network, identity, and cloud environments. The position serves as a Level 3 escalation point and incident commander, partnering with SOC, Threat Intelligence, and Detection Engineering teams. It requires participation in a 24/7 on-call rotation and is hybrid out of Draper, UT or Sunnyvale, CA.
Senior level · 12+ years · Salt Lake City, UT · Full-time
Advertised as Staff, but the requirements read as Senior.
“or” means any one of them counts — you don't need all of them.
We read this from the posting text with AI. Skim the description below before ruling yourself out.
How this req sits in the market our data
Roughly 10 people in the Salt Lake City, UT area plausibly meet what this posting asks for (information security analysts). range 2–15
Applicant volume Moderate — A normal amount of company. The rare requirements below are what will separate a shortlisted application from the rest.
Most people in this occupation already list these. Still required — just not what gets you shortlisted.
What the occupation pays Median $105,091 (middle half $79,899–$134,402). This posting is about at that midpoint.
Estimated from BLS employment for this occupation and area, per-skill prevalence across our listing corpus, and published wage benchmarks — as of Jul 29, 2026. It is a model, not a headcount.
Why we read it this way (6)
The role is listed as hybrid in Draper, UT or Sunnyvale, CA (4 days/week in office). The CBSA reported is Salt Lake City, UT (covering Draper); the Sunnyvale location falls under the San Jose-Sunnyvale-Santa Clara, CA CBSA (41940). Compensation ranges differ by geography — the SF Bay Area range ($187,700–$275,275) applies to Sunnyvale, while the 'all other' range ($137,000–$200,915) likely applies to Draper, UT. The min/max reported here span the full advertised range across both locations.
The alt SOC (15-1252 Software Developers) was considered because the role includes detection engineering, SOAR automation, and scripting — but the primary day-to-day work is clearly security analysis and incident response, so 15-1212 is the stronger fit.
The posting requires US Citizenship but does not gate on a specific security clearance, so clearance is set to None.
The title is explicitly 'Staff' and the role carries Staff-level framing (subject matter expert, cross-team technical leadership). However, the actual scope — leading a SOC function with 12+ years required — is consistent with a Senior individual contributor on most career ladders. 'Staff' is reported as the advertised level; the requirements support Senior.
Scripting is listed as a single requirement with Python, PowerShell, or Bash as interchangeable options; Python is used as the primary name with the others in alternatives.
Certifications (GCFA, GCIH, CISSP, CISM, OSCP) appear under Preferred Qualifications and are grouped as alternatives to a single preferred skill entry.
Read the full posting
The employer publishes the full description on their own site — read it there ↗. Or sign in to read it here — it's free, and it also lets you track this application.