Email Security and Social Engineering Analyst

· Address ServiceNow tickets related to phishing, email security, email delivery, and other assigned security issues within established service-level expectations.

· Troubleshoot email delivery issues by reviewing message tracking, filtering decisions, quarantines, authentication results, policy routes, allow and block controls, and other relevant data.

· Analyze message headers, sender behavior, URLs, attachments, redirects, and message context to determine whether an email is legitimate, suspicious, or malicious.

· Investigate social engineering activity, including phishing, impersonation, business email compromise, credential theft, malicious links, and fraudulent requests.

· Support digital risk protection activities by identifying, reviewing, and escalating external threats such as brand impersonation, fraudulent domains, malicious websites, and other risks targeting the organization, its associates, or its customers.

· Perform Tier 1 phishing triage and escalate confirmed threats or complex investigations as appropriate.

· Use sandboxing, threat intelligence, endpoint, identity, and logging tools to validate findings and determine potential impact.

· Support email authentication and protection controls, including DMARC, SPF, DKIM, policy routes, and email firewall rules.

· Search for related messages, contain threats, remove malicious emails, and support affected-user response actions.

· Support incident response for compromised user accounts and devices, including evidence collection, scoping, containment, escalation, remediation coordination, and documentation.

· Work with Identity, Endpoint, Security Operations, and other response teams to protect affected users, reset or secure access, isolate devices when appropriate, and confirm that threats have been contained.

· Document investigations, evidence, decisions, and actions accurately and consistently.

· Communicate findings and recommended actions to associates in clear, professional, and timely language.

· Partner with Security Operations, Threat Management, Security Engineering, Messaging, Identity, and other teams during investigations and incidents.

· Identify recurring patterns, control gaps, and opportunities to improve phishing detection, email delivery support, digital risk protection, and incident response processes.

· Participate in an after-hours rotation or respond outside normal business hours when required.

· Perform other duties as assigned.