# Security Engineer, Detection and Response at Paxos > Remote · United States · Unspecified · Security · open. Source: https://alderhq.app/jobs/ashby%3Apaxos%3Af0eece71-5927-4f49-bed2-9932af8edd9f (read 2026-11-06). ## Facts (observed) - Company: [Paxos](https://alderhq.app/companies/paxos) - Location text: Remote - United States - Where it can be done from (inferred): Remote · United States (evidence: "Location: Remote - United States") - Posted: 2026-09-29 (38 days ago) - First seen by alder: 2026-11-02 · last verified: 2026-11-04 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://jobs.ashbyhq.com/paxos/f0eece71-5927-4f49-bed2-9932af8edd9f - Skills listed (inferred): Python ## Pay and sponsorship - Posted pay: $169k–$194k per year (from the listing's pay field) - Market band for similar posted roles (United States, n 520): p25 $112k, median $156k, p75 $206k - H-1B filings at this company for similar roles, FY26: 4, median offered wage $181k ([US DOL OFLC LCA disclosure data](https://www.dol.gov/agencies/eta/foreign-labor/performance)) - Licensed UK sponsor: registered as "Paxos Technology Limited" (checked 2026-11-03, [register](https://www.gov.uk/government/publications/register-of-licensed-sponsors-workers)) ## Description (the employer's text) Applying to Paxos? Our only careers site is paxos.com/careers, and we only recruit via @paxos.com email. Details below. \_\_\_ ### About Paxos Today’s financial infrastructure is archaic, expensive, inefficient and risky — supporting a system that leaves out more people than it lets in. So we’re rebuilding it. We’re on a mission to open the world’s financial system to everyone by enabling the instant movement of any asset, any time, in a trustworthy way. For over a decade, we’ve built blockchain infrastructure that tokenizes, custodies, trades and settles assets for the world's leading financial institutions, like PayPal, Venmo, Mastercard, Interactive Brokers and Charles Schwab. ### About the team The Security team at Paxos protects the cloud infrastructure, crypto systems, endpoints, and network that our regulated financial platform runs on. You'll join the Detection and Response function, working alongside our 24x7 SOC, which handles first-line triage, and partnering with Product Security teams to validate that our coverage holds up against real attacker techniques. ### About the role The Detection and Response Engineer at Paxos serves as a builder of the detections, hunts, and automations that protect our cloud infrastructure, crypto systems, endpoints, and network. You will write detections as code and automate response, and act as a purple teamer, emulating attacks alongside our Product Security teams to confirm our detections work. Our 24x7 SOC handles first-line triage, so your focus is the detection engineering, threat hunting, and validation that make our coverage effective. Strong hands-on investigation skills are expected, but they support this work rather than define it. ### What you'll do Detection Coverage & Quality: Ship production-grade detections as code with measurable signal improvements—reducing false positives and closing gaps identified in purple team exercises. Validated Defenses: Run purple team exercises with other teams to confirm detection effectiveness and identify blind spots. Threat Hunting Program: Execute proactive hunts based on threat intelligence and convert findings into new detections and documented IOCs/TTPs. Operational Efficiency: Build automations to accelerate investigation and triage; create and maintain runbooks and incident write-ups that make response consistent and repeatable across the team. Detection Stack: Identify gaps and integrate best-in-class tools that increase team effectiveness and visibility across endpoints, cloud, network, and signing systems. ### About you You bring 3+ years of experience in security operations, detection engineering, offensive security testing, or a related security engineering role, and you're comfortable owning tickets and incidents end-to-end within established runbooks, escalating clearly when you hit the edge of your knowledge. You have hands-on experience investigating and responding to security threats across endpoints, cloud environments, and network telemetry, using existing tooling (SIEM, EDR, ticketing systems) effectively rather than needing to build it from scratch. You bring strong analytical judgment and a calm, methodical approach to triaging alerts and driving incidents through resolution, and you flag gaps in process or coverage as you find them. You have hands-on experience tuning detections in SIEM and EDR platforms to improve signal quality and reduce false positives, and can write or adapt detection rules from an existing template or pattern. You have used adversary-emulation or purple-team tooling to validate that your detections actually fire, and you understand common attack paths well enough to know what a given detection should — and shouldn't — catch. You are a builder who looks for opportunities to automate repetitive work, including using AI and scripting (Python/Bash) to speed up investigations. You communicate clearly within your immediate team, contribute meaningfully to post-incident write-ups, and act on feedback that sharpens your investigative and detection work. --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/ashby%3Apaxos%3Af0eece71-5927-4f49-bed2-9932af8edd9f and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.