Senior Email Security Specialist

🏗 We're Hiring: Senior Email Security Specialist

📍 Location: United Arab Emirates (Remote)

🕒 Employment Type: Full-Time

💼 Experience Level: Mid-Level to Senior

🌐 Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through operational excellence, effective communication, robust risk management, and collaborative project delivery. Our multidisciplinary teams span Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership.

As our operations increasingly depend on digital communication, protecting email systems against phishing, business email compromise, malware, impersonation, and data leakage is essential to maintaining business continuity and safeguarding sensitive information. We prioritize proactive cybersecurity, secure technology operations, and effective collaboration to protect our employees, projects, commercial relationships, and organizational assets.

The Role

We are seeking an experienced Senior Email Security Specialist to design, implement, administer, and continuously improve enterprise email security controls across cloud-based, on-premises, and hybrid messaging environments. The successful candidate will possess strong expertise in email threat protection, phishing defense, email authentication, security monitoring, incident response, data loss prevention, and messaging security architecture.

This role will be responsible for strengthening defenses against sophisticated email-borne threats, investigating suspicious messages, managing security policies, improving detection capabilities, and ensuring that email communications remain secure and reliable. The specialist will work closely with Cybersecurity, Information Security, IT Infrastructure, Messaging, Identity and Access Management, Legal, Compliance, and business stakeholders to reduce email-related risks and maintain effective security governance.

The position will also support security awareness initiatives, technical investigations, audit activities, and continuous improvement programs to protect confidential construction contracts, project documentation, financial information, procurement communications, employee records, and other sensitive business data.

Key Responsibilities1. Enterprise Email Security Administration

• Administer, configure, and optimize enterprise email security platforms across Microsoft 365, Exchange Online, on-premises Exchange, and other approved messaging environments.
• Manage email security technologies such as Microsoft Defender for Office 365, Exchange Online Protection, secure email gateways, and comparable third-party solutions.
• Configure and maintain anti-spam, anti-malware, anti-phishing, impersonation protection, and malicious attachment detection policies.
• Establish appropriate security baselines for inbound, outbound, and internal email communications.
• Review and optimize security policies to balance effective threat prevention with legitimate business communication requirements.
• Maintain email security configurations for corporate users, project teams, executives, finance personnel, procurement staff, and external-facing business functions.
• Administer allowlists, blocklists, quarantine policies, trusted senders, and permitted domains under controlled approval procedures.
• Review platform configurations regularly to identify weaknesses, outdated settings, excessive exclusions, and unnecessary security exceptions.
• Maintain accurate documentation of email security architecture, configurations, policies, dependencies, and administrative procedures.
• Ensure email security services remain aligned with organizational cybersecurity standards and operational requirements.

2. Phishing and Business Email Compromise Prevention

• Develop and maintain technical controls to detect and prevent phishing, spear-phishing, credential theft, business email compromise, and executive impersonation.
• Configure protection against display-name spoofing, domain impersonation, lookalike domains, suspicious sender behavior, and fraudulent reply-to addresses.
• Investigate emails containing suspicious links, malicious attachments, credential harvesting pages, QR-code phishing, and social engineering attempts.
• Analyze phishing campaigns targeting employees, executives, finance teams, procurement personnel, and project stakeholders.
• Identify indicators of business email compromise, including unauthorized mailbox rules, suspicious forwarding, unusual sign-in patterns, and fraudulent payment instructions.
• Coordinate with Finance and Procurement teams to strengthen verification procedures for changes to supplier banking details, payment instructions, and sensitive commercial requests.
• Implement appropriate protections for executive communications and other high-risk user groups.
• Support the detection and removal of malicious emails from user mailboxes using approved investigation and remediation tools.
• Develop repeatable procedures for reporting, investigating, containing, and communicating phishing incidents.
• Recommend enhancements based on emerging attack techniques, threat intelligence, and lessons learned from security incidents.

3. Email Threat Detection and Investigation

• Monitor email security dashboards, threat alerts, quarantine events, detection logs, and suspicious messaging activity.
• Investigate malicious attachments, suspicious URLs, spoofed messages, unauthorized senders, and anomalous email behavior.
• Analyze message headers, sender infrastructure, authentication results, URLs, attachment characteristics, and delivery paths.
• Use approved threat intelligence sources, sandboxing technologies, reputation services, and analysis tools to assess suspicious content.
• Correlate email telemetry with identity, endpoint, network, and cloud security events to establish the scope of potential incidents.
• Identify affected users, recipients, mailboxes, systems, and business processes during email security investigations.
• Determine whether suspicious messages were delivered, opened, clicked, forwarded, or associated with credential compromise.
• Document investigation findings, evidence, timelines, indicators of compromise, and recommended remediation actions.
• Distinguish legitimate business communications from malicious activity and reduce unnecessary security alerts.
• Escalate significant threats and unresolved cases to Cybersecurity leadership or the designated incident response team.

4. Email Security Incident Response

• Lead or support incident response activities involving phishing, malware delivery, account compromise, spoofing, unauthorized forwarding, and email-based fraud.
• Coordinate containment actions, including message purging, sender blocking, malicious URL restrictions, mailbox rule removal, and account security remediation.
• Support authorized credential resets, session revocation, multi-factor authentication reviews, and access restrictions when accounts are suspected of compromise.
• Work with endpoint security teams to investigate potential malware execution following malicious email interactions.
• Preserve relevant email artifacts, message traces, audit records, and technical evidence for authorized investigation.
• Assess the scope, business impact, root cause, and potential data exposure associated with email security incidents.
• Coordinate with Legal, Compliance, Risk Management, Human Resources, and business leadership when incidents involve sensitive information or suspected fraud.
• Maintain incident records and ensure corrective actions are assigned, tracked, and completed.
• Prepare incident reports outlining attack methods, affected systems, containment measures, lessons learned, and preventive recommendations.
• Participate in post-incident reviews and implement improvements to prevent recurrence.

5. Email Authentication and Domain Protection

• Implement, maintain, and validate Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) configurations.
• Review email authentication results to identify spoofing attempts, unauthorized sending sources, and misconfigured legitimate services.
• Coordinate with DNS, domain administration, messaging, and application teams to maintain accurate email authentication records.
• Develop and manage DMARC monitoring and enforcement strategies based on organizational risk, domain readiness, and legitimate sending requirements.
• Investigate domain impersonation, lookalike domains, unauthorized use of organizational branding, and fraudulent sender identities.
• Review reports from email authentication services to identify unauthorized senders and configuration problems.
• Validate third-party email sending arrangements involving enterprise applications, suppliers, marketing platforms, and business service providers.
• Maintain approved inventories of organizational domains and authorized email-sending services.
• Support appropriate controls for subdomains, delegated domains, and domains used for project-related or external communications.
• Recommend improvements to domain protection, sender validation, and email trust mechanisms.

6. Email Gateway and Messaging Security Architecture

• Design, implement, and maintain secure email gateway configurations and related messaging security components.
• Configure inbound and outbound filtering, routing policies, connector restrictions, TLS requirements, and other applicable email transport controls.
• Review mail flow paths to identify unauthorized relays, insecure connections, unnecessary trust relationships, and potential security bypasses.
• Integrate email security controls with Microsoft 365, Exchange, identity platforms, security information and event management systems, and other approved tools.