Principal Security Engineer, Detection & Response

About Circle

Circle (NYSE: CRCL) is a leading global internet financial platform company focused on advancing a more open global economy. Our platform features the largest regulated stablecoin network powered by USDC, a global payments network, and Arc, an enterprise-grade blockchain aiming to be the foundation of the internet's Economic OS. Our customers include enterprises, financial institutions, and developers driving trusted financial innovation at scale.

Role Overview

As part of the Circle Security Team, you will be integral to safeguarding our company, customers, partners, and the financial markets that we rely upon. This role requires a Principal-level technical expert who leads projects responsible for key security deliverables while collaborating extensively across teams. You will specialize deeply in three critical threat domains: blockchain and custody systems (including USDC issuance, Arc, and on-chain monitoring), cloud-native infrastructure (AWS and EKS), and AI-driven tooling internal to Circle and in our products. Building detection and response mechanisms across these domains will be your focus.

Responsibilities

• Identify and proactively respond to emerging security threats across cloud environments, endpoints, blockchain platforms, and AI systems.
• Establish detection and response capabilities targeting blockchain and crypto-native threats such as on-chain anomalies, custody-vault system interactions, wallet misuse, smart contract exploitation, and protocol attacks against Circle’s blockchain offerings.
• Create detection frameworks for cloud-native threats in AWS and EKS including IAM compromises, identity federation abuses, lateral movements in containers, runtime exploitations, and monitoring configuration drift.
• Extend detection solutions to tackle AI-specific risks including shadow AI adoption, unauthorized integrations, agentic workflows, tool abuse, and AI-driven credential leaks.
• Champion AI deployment within our Security Operations Center to enhance detection triage, enrichment, and analyst productivity.
• Manage and improve core security tooling like SIEM and orchestration platforms.
• Identify infrastructural visibility gaps and collaborate with business partners to enhance logging and detection capabilities.
• Lead incident response activities and work cross-functionally to investigate and remediate security incidents.
• Develop sophisticated detection strategies to identify anomalous behaviors and attack vectors.
• Offer security advice and guidance to various company divisions.
• Support the broader security initiatives such as threat modeling, vulnerability assessments, audits, and custom tool development.
• Participate in on-call rotations primarily during business hours with occasional nights and weekends.

Qualifications and Skills

• Extensive experience in detection, response, and security engineering, typically over 10 years.
• Proven leadership in leading security incident responses, especially complex cases involving engineering, with at least 3 years commanding such incidents.
• In-depth cloud security expertise, particularly with AWS environments covering IAM, identity federation, KMS, EKS/container attack methods, runtime exploitation, and CSPM tools like Wiz; familiarity with GCP or OCI is a plus.
• Solid understanding of blockchain and crypto-specific threats including wallet and custody attack patterns, on-chain monitoring, and smart contract abuses; prior hands-on defense experience in blockchain, custody, or DeFi domains is highly desirable.
• Practical experience leveraging AI technologies both for enhancing security workflows and mitigating AI-induced risks such as shadow AI, agentic workflows, and misuse of AI tools.
• Broad knowledge of SIEM, case management, and SOAR technologies, for example Panther and Tines.
• Technical expertise with macOS operating systems including file systems and memory structure.
• Programming proficiency in Python, Golang, or similar languages with experience developing Detections as Code.

Personal Attributes

• Collaborative under pressure, able to coordinate effectively across teams during critical incidents including outside regular hours.
• Strong organizational skills to prioritize multiple urgent demands dynamically.
• Self-driven, innovative problem solver capable of working autonomously.
• Comfortable with Slack, Apple macOS environments, and GSuite productivity tools.
• Positive, open communicator who embraces challenges and shares solutions.

Additional Information

This role involves on-call duties approximately every third week and occasional weekend shifts. The compensation range for this position is between €110,000 and €170,000 annually, determined by experience, skills, and organizational needs. Circle values diversity and inclusion and provides accommodations for candidates throughout the hiring process. We are an equal opportunity employer not discriminating on any protected class bases.