Principal Security Detection & Response Engineer

Circle; United States; Remote; USD 127,000 - 196,000; Full time

Job summary

Circle is seeking a Principal Security Engineer to lead detection and response across blockchain, cloud, and AI surfaces. You will collaborate with engineering teams and advance tooling, detection coverage, and incident response capabilities.

The role involves active on‑call duties (scheduled shifts) and contributing to threat modeling, vulnerability assessments, and custom security tooling in a fast‑paced environment.

Qualifications

• 10+ years of experience in detection, response, or security engineering.
• 3+ years of experience commanding security incidents, especially those involving engineering.
• Deep cloud security knowledge in AWS environments: IAM, identity federation, KMS, EKS/container attack patterns, CSPM tooling.
• Working knowledge of blockchain and crypto‑native threats: wallet and custody attack patterns, on‑chain monitoring, protocol‑level risks, and smart contract abuse.
• Hands‑on experience using AI tooling to accelerate work and address threats, with understanding of shadow AI and MCP/tool integrations.
• Extensive knowledge of SIEM, Case Management, and SOAR solutions (e.g., Panther, Tines).
• Programming experience in Python, Golang, or similar languages.
• Experience with building Detections As Code.

Responsibilities

• Lead security projects and deliverables across Circle teams.
• Develop detection for blockchain, cloud, and AI surfaces.
• Respond to incidents and coordinate across teams.
• On‑call duties during working hours; occasional night/weekend incidents.
• Provide security guidance to various organizations within Circle.
• Support threat modeling, vulnerability scans, audits, and custom tool building.

Skills

Security engineering

Incident response

Cloud security

Threat detection

Python/Golang

SIEM/SOAR

Tools

Panther

Tines

Wiz

AWS

GCP

Job description

Circle is seeking a Principal Security Engineer to lead detection and response across blockchain, cloud, and AI surfaces. You will collaborate with engineering teams and advance tooling, detection coverage, and incident response capabilities.

The role involves active on‑call duties (scheduled shifts) and contributing to threat modeling, vulnerability assessments, and custom security tooling in a fast‑paced environment.