Security Engineer, Detection and Response

As a Detection and Response Engineer at Paxos, you will build the detections, hunts, and automations that protect cloud infrastructure, crypto systems, endpoints, and network. You act as both a builder, writing detections as code and automating response, and as a purple teamer, emulating attacks with Product Security teams to confirm detections work. A 24x7 SOC handles first-line triage while you focus on detection engineering, threat hunting, and validation that make coverage effective.

What you'll do

• Ship production-grade detections as code with measurable signal improvements that reduce false positives and close gaps identified in purple team exercises
• Run purple team exercises with other teams to confirm detection effectiveness and identify blind spots
• Execute proactive threat hunts based on threat intelligence and convert findings into new detections and documented IOCs and TTPs
• Build automations to accelerate investigation and triage, and create and maintain runbooks and incident write-ups that make response consistent and repeatable
• Identify gaps in your detection stack and integrate best-in-class tools that increase team effectiveness and visibility across endpoints, cloud, network, and signing systems

What you bring

• 3+ years of experience in security operations, detection engineering, offensive security testing, or a related security engineering role
• Hands-on experience investigating and responding to security threats across endpoints, cloud environments, and network telemetry using SIEM, EDR, and ticketing systems
• Strong analytical judgment and a methodical approach to triaging alerts and driving incidents through resolution
• Hands-on experience tuning detections in SIEM and EDR platforms to improve signal quality and reduce false positives, and the ability to write or adapt detection rules from existing templates or patterns
• Experience using adversary-emulation or purple-team tooling to validate that detections fire, and understanding of common attack paths
• Ability to identify opportunities to automate repetitive work using Python, Bash, or similar scripting to speed up investigations
• Clear communication with your immediate team, meaningful contribution to post-incident write-ups, and openness to feedback that sharpens your investigative and detection work
• Willingness to participate in an on-call rotation and document incidents clearly to support continuous improvement

About Paxos

Paxos rebuilds financial infrastructure by enabling the instant movement of any asset in a trustworthy way. For over a decade, the company has built blockchain infrastructure that tokenizes, custodies, trades and settles assets for leading financial institutions including PayPal, Venmo, Mastercard, Interactive Brokers and Charles Schwab.