Principal Security Engineer, Detection & Response

• Proactively identify and respond to emerging security threats across cloud, endpoint, blockchain, and AI surfaces.

• Build detection and response capability for blockchain and crypto-native threats: on-chain anomalies, custody-vault interactions, wallet abuse, smart contract exploitation, and protocol-level attackers targeting USDC and Circle's blockchain products.

• Develop detection coverage for cloud-native attacks across AWS + EKS: IAM compromise, identity federation abuse, lateral movement in containerized workloads, runtime exploitation, and misconfiguration drift.

• Extend detection for AI-specific risks: shadow AI adoption, unauthorized AI integrations, agentic workflows and MCP/tool abuse, and AI-driven credential exposure.

• Advance deployment of AI to the SOC function including detection triage, enrichment, and analyst-acceleration workflows.

• Develop plans to manage and maintain core tooling, such as SIEM and Orchestration platforms.

• Identify gaps in our infrastructure, and work with business partners to gain visibility through logging and detection.

• Lead and respond to incidents and collaborate across teams to investigate and resolve.

• Develop detection techniques to identify anomalous behaviors and attacks across the environment.

• Provide security guidance to various organizations throughout the company.

• Support broader security team projects such as threat modeling, vulnerability scanning, audits, and custom tool building.

• Take on-call shifts (every 3rd week and occasional weekend).

• Strong ability to work collaboratively across teams during high-stress situations, which sometimes involves after hours work.

• Ability to manage multiple competing priorities and use good judgment to establish order of priorities on the fly.

• Self-motivated and creative problem-solver able to work independently with minimal guidance.

• Experience/familiarity with Slack, Apple macOS, and GSuite.

• 10+ years of experience in detection, response, or security engineering.

• 3+ years of experience commanding security incidents, especially those involving engineering.

• Deep cloud security knowledge in AWS environments: IAM, identity federation, KMS, EKS/container attack patterns, runtime exploitation, and CSPM tooling (e.g., Wiz). Some exposure to GCP or OCI is preferred.

• Working knowledge of blockchain and crypto-native threats: wallet and custody attack patterns, on-chain monitoring, protocol-level risks, and smart contract abuse. Direct experience defending blockchain, custody, or DeFi infrastructure is strongly preferred.

• Hands-on experience using AI tooling both to accelerate work and to address threats, coupled with a strong understanding of the organizational risks AI introduces shadow AI, agentic workflows, MCP/tool integrations, and strategies to defend against them.

• Extensive knowledge of SIEM, Case Management, and SOAR solutions (e.g., Panther, Tines).

• Knowledge of operating systems, file systems, and memory on macOS.

• Programming experience in Python, Golang, or similar programming languages.

• Experience with building Detections As Code.

• View Security Detection & Response as a data and engineering problem.

• Exude positivity.

• Aren't afraid to share your ideas.

• Meet problems head-on and view them as opportunities.

• Are self-reliant and motivated.

• Communicate fearlessly.

Circle is on a mission to create an inclusive financial future, with transparency at our core. We consider a wide variety of elements when crafting our compensation ranges and total compensation packages.

Starting pay is determined by various factors, including but not limited to: relevant experience, skill set, qualifications, and other business and organizational needs. Please note that compensation ranges may differ for candidates in other locations.

Base Pay Range: €110,000.00 - €170,000.00 We are an