Principal Security Engineer, Detection & Response

The Circle Security Team works to protect Circle; our customers, clients, and partners; and the financial markets upon which we rely. As a member of this team, you'll lead projects and be responsible for key deliverables of the security program while collaborating across Circle teams. You will continue to learn and stay current in a fun and rapidly changing environment. This role sits at the intersection of three of Circle's highest-stakes threat surfaces: our blockchain and custody environments (USDC issuance, Arc, on-chain monitoring), our cloud-native infrastructure (AWS + EKS), and the AI tooling Circle adopts internally and ships in product. You'll build detection coverage and response capability across all three; not as a generalist, but as a Principal who can go deep on each. Also note that this position will require you to perform on-call duties mainly during working hours to support security operations, and you will assist the team with the occasional night time and weekend incident. We would also like someone with a strong response background and some exposure to insider risk. What you'll work on: Proactively identify and respond to emerging security threats across cloud, endpoint, blockchain, and AI surfaces. Build detection and response capability for blockchain and crypto-native threats: on-chain anomalies, custody-vault interactions, wallet abuse, smart contract exploitation, and protocol-level attackers targeting USDC and Circle's blockchain products. Develop detection coverage for cloud-native attacks across AWS + EKS: IAM compromise, identity federation abuse, lateral movement in containerized workloads, runtime exploitation, and misconfiguration drift. Extend detection for AI-specific risks: shadow AI adoption, unauthorized AI integrations, agentic workflows and MCP/tool abuse, and AI-driven credential exposure. Advance deployment of AI to the SOC function including detection triage, enrichment, and analyst-acceleration workflows. Develop plans to manage and maintain core tooling, such as SIEM and Orchestration platforms. Identify gaps in our infrastructure, and work with business partners to gain visibility through logging and detection. Lead and respond to incidents and collaborate across teams to investigate and resolve. Develop detection techniques to identify anomalous behaviors and attacks across the environment. Provide security guidance to various organizations throughout the company. Support broader security team projects such as threat modeling, vulnerability scanning, audits, and custom tool building. Take on-call shifts (every 3rd week and occasional weekend).