Email Threat Detection Engineer

Protect millions of inboxes. Detect the attacks others miss. This is not a SOC role. It isn't a penetration testing role. It isn't a DevSecOps or cloud security engineering role. We're looking for someone with deep, hands-on experience protecting large-scale email platforms from spam, phishing, malware and business email compromise. Please note this role supports the EU timezone, hence the shift will start around 1pm PH time into the evening. If you've spent your career developing detection logic, tuning email filtering systems, analysing mail flows and improving the effectiveness of anti-abuse platforms, we'd like to hear from you. At Atmail, you'll join our Email Specialist team responsible for protecting email services used by telecommunications providers, internet service providers, businesses and consumers around the world. You'll investigate emerging threats, build detection logic, reduce false positives and continuously improve the security of our email platform. What You'll Be Doing Investigate spam, phishing, malware and business email compromise (BEC) campaigns. Develop, test and optimise regex-based detection rules. Analyse mail logs, authentication results and abuse signals to identify emerging threats. Reduce false positives and false negatives through continual tuning of filtering rules. Monitor email traffic to identify compromised accounts and new attack techniques. Work closely with engineering and Level 3 Support teams to improve platform security. Recommend improvements to detection logic, tooling and operational processes. Contribute to technical decisions that strengthen Atmail's email security capability. Essential Requirements To be successful in this role, you must be able to demonstrate most of the following: Email Security Experience At least 5 years' hands-on experience working in email security, anti-abuse, email filtering, threat detection or large-scale email operations. Experience investigating phishing, spam, malware, business email compromise (BEC) and other email-based attacks. Experience analysing mail logs and identifying abuse patterns. Detection Engineering Strong experience creating, analysing and optimising regular expressions (Regex) (PCRE, RE2 or similar). Experience developing and tuning production email filtering or anti-spam rules. Proven experience reducing false positives and false negatives through detection tuning. Technical Knowledge Strong working knowledge of: SMTP IMAP POP3 DNS SPF DKIM DMARC ARC SRS Email Security Technologies Experience working with one or more of the following: SpamAssassin Rspamd Cloudmark Proofpoint Cyren / Data443 Vade Spamhaus Abusix SORBS Return Path Technical Skills Linux / UNIX command-line experience. Ability to analyse operational data and mail logs. Excellent analytical and troubleshooting skills. Strong written and verbal communication. Comfortable working autonomously in a fully remote team. Highly Regarded Python or Bash scripting. AWS cloud experience. Experience configuring or operating email server technologies. Experience working in Trust & Safety or Abuse teams. M3AAWG participation or involvement. Experience working across global teams. You'll Stand Out If You've Worked At We're particularly interested in candidates with experience from organisations such as: Trend Micro Proofpoint Mimecast Barracuda Cofense Microsoft (Defender for Office 365) Google Workspace / Gmail Security Cisco Secure Email Email service providers Anti-abuse teams Threat research teams This Role Is NOT This role is not a DevSecOps Engineer, Platform Engineer, Infrastructure Engineer or Software Developer position. If your recent experience has primarily been building cloud infrastructure, compliance automation, Infrastructure-as-Code or CI/CD pipelines, you'll likely be a stronger fit for our Security Systems Developer role which you can find advertised on our LinkedIn Company Page. Why Join Atmail? Atmail powers email platforms trusted by telecommunications providers, internet service providers and organisations around the world. You'll work alongside experienced email security professionals solving real-world abuse problems at scale—not in a lab or simulation, but in live production environments where your work directly improves the security and reliability of millions of mailboxes.

We offer
Fully remote work with genuine flexibility. Complex technical challenges that evolve every day. High levels of autonomy and ownership. A collaborative engineering culture where expertise is valued. The opportunity to influence how a global email platform detects and responds to emerging threats.