Senior Security Engineer, Detection and Response

As a Senior Detection and Response Engineer at Paxos, you will build the detections, hunts, and automations that protect the company's cloud infrastructure, crypto systems, endpoints, and network. You act as both a builder, writing detections as code and automating response, and a purple teamer, emulating attacks with the Product Security teams to confirm detections work. Our 24x7 SOC handles first-line triage, while you focus on detection engineering, threat hunting, and validation that make coverage effective.

What you'll do

• Ship production-grade detections as code with measurable signal improvements, reducing false positives and closing gaps identified in purple team exercises
• Run purple team exercises with other teams to confirm detection effectiveness and identify blind spots
• Execute proactive threat hunts based on threat intelligence and convert findings into new detections and documented IOCs and TTPs
• Build automations to accelerate investigation and triage; create and maintain runbooks and incident write-ups that make response consistent and repeatable across the team
• Identify gaps in the detection stack and integrate best-in-class tools that increase team effectiveness and visibility across endpoints, cloud, network, and signing systems
• Mentor junior members of the team and serve as a trusted technical escalation point
• Participate in an on-call rotation and act as incident commander when needed, driving structural fixes that prevent recurring incident classes
• Communicate fluently with engineering leadership and cross-functional stakeholders during major incidents; shape team direction through documentation and retrospectives

What you bring

• 5-8+ years of experience in security operations, detection engineering, offensive security testing, or a related security engineering role, with a track record of scope growth
• The ability to independently own complex, ambiguous, or multi-stage incidents from initial triage through containment, eradication, and recovery, making decisions in the moment and building or improving runbooks rather than waiting for them to exist
• Deep, hands-on expertise in SIEM and EDR platforms; the ability to design new detections from scratch, own detection strategy for a significant surface area, and meaningfully reduce false-positive rates
• Experience designing and running purple-team exercises in partnership with other engineering teams, emulating real attacker techniques and using findings to reshape the detection roadmap
• A strong point of view on what tools and architecture the team should invest in, and the ability to make credible build-versus-buy calls
• A builder's mindset with continuous focus on automating repetitive security workflows and applying AI thoughtfully to improve the speed, consistency, and scale of investigation and response
• The ability to produce original threat intelligence assessments and run proactive threat hunts based on hypotheses, translating findings directly into new detections and a stronger roadmap
• A track record of measurably accelerating others' growth through active mentorship

About Paxos

Paxos is rebuilding financial infrastructure to open the world's financial system to everyone by enabling the instant movement of any asset, any time, in a trustworthy way. For over a decade, the company has built blockchain infrastructure that tokenizes, custodies, trades and settles assets for leading financial institutions including PayPal, Venmo, Mastercard, Interactive Brokers and Charles Schwab.