{"id":2496627,"url":"https://alion.io/job/circle-principal-security-engineer-detection-response","title":"Principal Security Engineer, Detection & Response","company":{"id":12303,"name":"Circle","domain":"circle.com","url":"https://alion.io/company/circle","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Phenom","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Boston, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":170000,"currency":"EUR","period":"year","gross":null,"usd_annual":190223},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"DeFi","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"IAM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Slack","optional":false},{"name":"Smart Contracts","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Tines","optional":false},{"name":"Wiz","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-09-22T00:00:00Z","employer_posted_date":"2026-09-22","last_verified_at":"2026-10-14T20:30:43Z","board_verified":true,"closed_at":null,"days_open":22,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":22},"description":"Circle (NYSE: CRCL) is one of the world’s leading internet financial platform companies, building the foundation of a more open, global economy through digital assets, payment applications, and programmable blockchain infrastructure. Circle’s platform includes the world’s largest regulated stablecoin network anchored by USDC, Circle Payments Network for global money movement, and Arc, an enterprise-grade blockchain designed to become the Economic OS for the internet. Enterprises, financial institutions, and developers use Circle to power trusted, internet-scale financial innovation. Learn more at circle.com.\nWhat you’ll be part of:\nCircle is committed to visibility and stability in everything we do. As we grow as an organization, we're expanding into some of the world's strongest jurisdictions. Speed and efficiency are motivators for our success and our employees live by our company values: High Integrity, Future Forward, Multistakeholder, Mindful, and Driven by Excellence. We have built a flexible work environment where new ideas are encouraged and everyone is a stakeholder.\nWhat you'll be responsible for:\nThe Circle Security Team works to protect Circle; our customers, clients, and partners; and the financial markets upon which we rely.\nAs a member of this team, you'll lead projects and be responsible for key deliverables of the security program while collaborating across Circle teams. You will continue to learn and stay current in a fun and rapidly changing environment.\nThis role sits at the intersection of three of Circle's highest-stakes threat surfaces: our blockchain and custody environments (USDC issuance, Arc, on-chain monitoring), our cloud-native infrastructure (AWS + EKS), and the AI tooling Circle adopts internally and ships in product. You'll build detection coverage and response capability across all three; not as a generalist, but as a Principal who can go deep on each.\nAlso note that this position will require you to perform on-call duties mainly during working hours to support security operations, and you will assist the team with the occasional night time and weekend incident. We would also like someone with a strong response background and some exposure to insider risk.\nWhat you'll work on:\nProactively identify and respond to emerging security threats across cloud, endpoint, blockchain, and AI surfaces.\n\nBuild detection and response capability for blockchain and crypto-native threats: on-chain anomalies, custody-vault interactions, wallet abuse, smart contract exploitation, and protocol-level attackers targeting USDC and Circle's blockchain products.\n\nDevelop detection coverage for cloud-native attacks across AWS + EKS: IAM compromise, identity federation abuse, lateral movement in containerized workloads, runtime exploitation, and misconfiguration drift.\n\nExtend detection for AI-specific risks: shadow AI adoption, unauthorized AI integrations, agentic workflows and MCP/tool abuse, and AI-driven credential exposure.\n\nAdvance deployment of AI to the SOC function including detection triage, enrichment, and analyst-acceleration workflows.\n\nDevelop plans to manage and maintain core tooling, such as SIEM and Orchestration platforms.\n\nIdentify gaps in our infrastructure, and work with business partners to gain visibility through logging and detection.\n\nLead and respond to incidents and collaborate across teams to investigate and resolve.\n\nDevelop detection techniques to identify anomalous behaviors and attacks across the environment.\n\nProvide security guidance to various organizations throughout the company.\n\nSupport broader security team projects such as threat modeling, vulnerability scanning, audits, and custom tool building.\n\nTake on-call shifts (every 3rd week and occasional weekend).\n\nWhat you'll bring to Circle:\nStrong ability to work collaboratively across teams during high-stress situations, which sometimes involves after hours work.\n\nAbility to manage multiple competing priorities and use good judgment to establish order of priorities on the fly.\n\nSelf-motivated and creative problem-solver able to work independently with minimal guidance.\n\nExperience/familiarity with Slack, Apple macOS, and GSuite.\n\nWe're looking for strong, impactful work experience, which typically includes:\n10+ years of experience in detection, response, or security engineering.\n\n3+ years of experience commanding security incidents, especially those involving engineering.\n\nDeep cloud security knowledge in AWS environments: IAM, identity federation, KMS, EKS/container attack patterns, runtime exploitation, and CSPM tooling (e.g., Wiz). Some exposure to GCP or OCI is preferred.\n\nWorking knowledge of blockchain and crypto-native threats: wallet and custody attack patterns, on-chain monitoring, protocol-level risks, and smart contract abuse. Direct experience defending blockchain, custody, or DeFi infrastructure is strongly preferred.\n\nHands-on experience using AI tooling both to accelerate work and to address threats, coupled with a strong understanding of the organizational risks AI introduces shadow AI, agentic workflows, MCP/tool integrations, and strategies to defend against them.\n\nExtensive knowledge of SIEM, Case Management, and SOAR solutions (e.g., Panther, Tines).\n\nKnowledge of operating systems, file systems, and memory on macOS.\n\nProgramming experience in Python, Golang, or similar programming languages.\n\nExperience with building Detections As Code.\n\nYou are the right person if you:\nView Security Detection & Response as a data and engineering problem.\n\nExude positivity.\n\nAren't afraid to share your ideas.\n\nMeet problems head-on and view them as opportunities.\n\nAre self-reliant and motivated.\n\nCommunicate fearlessly.\n\nCircle is on a mission to create an inclusive financial future, with transparency at our core. We consider a wide variety of elements when crafting our compensation ranges and total compensation packages.\nStarting pay is determined by various factors, including but not limited to: relevant experience, skill set, qualifications, and other business and organizational needs. Please note that compensation ranges may differ for candidates in other locations.\nBase Pay Range: €110,000.00 - €170,000.00We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status, or any other protected status required by the laws in the locations where we hire. Additionally, Circle participates in the E-Verify Program in certain locations, as required by law.\nShould you require accommodations or assistance in our interview process because of a disability, please reach out to  for support. We respect your privacy and will connect with you separately from our interview process to accommodate your needs.","description_format":"text","description_chars":6883,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Blockchain Infrastructure","Crypto Payments","Stablecoins"],"lifecycle":[{"event":"open","at":"2026-10-14T04:48:09Z"}],"visa":[],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.819,"p_room":0.9,"age_days":22,"expected_fill_days":44,"reasons":["conf:1","win:mid"],"computed_at":"2026-10-14T06:34:16Z"},"pay":{"stated_usd_annual":190223,"is_top_pay":false},"html_url":"https://alion.io/job/circle-principal-security-engineer-detection-response","json_url":"https://alion.io/job/circle-principal-security-engineer-detection-response.json","meta":{"generated_at":"2026-10-14T21:38:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29073,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":12303},"rest":"https://alion.io/mcp/rest/get_company?id=12303"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcircle-principal-security-engineer-detection-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcircle-principal-security-engineer-detection-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcircle-principal-security-engineer-detection-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/circle-principal-security-engineer-detection-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcircle-principal-security-engineer-detection-response"}]}