Principal Security Engineer, Detection & Response
Job description
Principal security role on Circle's Security Team focused on detection and response across blockchain/custody environments, AWS cloud-native infrastructure, and AI tooling. The role builds detection coverage and leads incident response across these three threat surfaces.
At a glance
- Employment
- Full-time
- Work mode
- Remote
- Pay
- EUR 110,000 – 170,000 / year
What you'll do
- Proactively identify and respond to emerging security threats across cloud, endpoint, blockchain, and AI surfaces
- Build detection and response capability for blockchain and crypto-native threats: on-chain anomalies, custody-vault interactions, wallet abuse, smart contract exploitation, and protocol-level attackers targeting USDC and Circle's blockchain products
- Develop detection coverage for cloud-native attacks across AWS + EKS: IAM compromise, identity federation abuse, lateral movement in containerized workloads, runtime exploitation, and misconfiguration drift
- Extend detection for AI-specific risks: shadow AI adoption, unauthorized AI integrations, agentic workflows and MCP/tool abuse, and AI-driven credential exposure
- Advance deployment of AI to the SOC function including detection triage, enrichment, and analyst-acceleration workflows
- Develop plans to manage and maintain core tooling, such as SIEM and Orchestration platforms
- Identify gaps in infrastructure and work with business partners to gain visibility through logging and detection
- Lead and respond to incidents and collaborate across teams to investigate and resolve
- Develop detection techniques to identify anomalous behaviors and attacks across the environment
- Provide security guidance to various organizations throughout the company
- Support broader security team projects such as threat modeling, vulnerability scanning, audits, and custom tool building
- Take on-call shifts (every 3rd week and occasional weekend)
What we're looking for
- Strong ability to work collaboratively across teams during high-stress situations, which sometimes involves after hours work
- Ability to manage multiple competing priorities and use good judgment to establish order of priorities on the fly
- Self-motivated and creative problem-solver able to work independently with minimal guidance
- Experience/familiarity with Slack, Apple macOS, and GSuite
- 10+ years of experience in detection, response, or security engineering
- 3+ years of experience commanding security incidents, especially those involving engineering
- Deep cloud security knowledge in AWS environments: IAM, identity federation, KMS, EKS/container attack patterns, runtime exploitation, and CSPM tooling (e.g., Wiz)
- Working knowledge of blockchain and crypto-native threats: wallet and custody attack patterns, on-chain monitoring, protocol-level risks, and smart contract abuse
- Hands-on experience using AI tooling both to accelerate work and to address threats, coupled with a strong understanding of the organizational risks AI introduces: shadow AI, agentic workflows, MCP/tool integrations, and strategies to defend against them
- Extensive knowledge of SIEM, Case Management, and SOAR solutions (e.g., Panther, Tines)
- Knowledge of operating systems, file systems, and memory on macOS
- Programming experience in Python, Golang, or similar programming languages
- Experience with building Detections As Code
Nice to have
- Some exposure to GCP or OCI is preferred
- Direct experience defending blockchain, custody, or DeFi infrastructure is strongly preferred
Your team
Security Team
The Circle Security Team works to protect Circle; our customers, clients, and partners; and the financial markets upon which we rely.
Apply
Direct apply at Circle
Opens the job posting at Circle
About Circle
One of the world's leading internet financial platform companies
Circle (NYSE: CRCL) is one of the world's leading internet financial platform companies, building the foundation of a more open, global economy through digital assets, payment applications, and programmable blockchain infrastructure. Circle's platform includes the world's largest regulated stablecoin network anchored by USDC, Circle Payments Network for global money movement, and Arc, an enterprise-grade blockchain designed to become the Economic OS for the internet. Enterprises, financial institutions, and developers use Circle to power trusted, internet-scale financial innovation.
Mission
To create an inclusive financial future, with transparency at our core; building the foundation of a more open, global economy through digital assets, payment applications, and programmable blockchain infrastructure.
Key facts
- Internet financial platform / digital assets and blockchain infrastructure
- NYSE: CRCL
- Platform includes the world's largest regulated stablecoin network anchored by USDC
- Circle Payments Network for global money movement
- Arc, an enterprise-grade blockchain designed to become the Economic OS for the internet
- Expanding into some of the world's strongest jurisdictions
- Flexible work environment
What they value
- High Integrity
- Future Forward
- Multistakeholder
- Mindful
- Driven by Excellence