Specialist, CSIRT

CoinbaseRemote

SecurityMid

Join Coinbase Security Operations to defend the company and its customers through frontline incident response, detection, automation, and continuous monitoring.

As a Security Operations Specialist on the Security Operations team, you'll defend Coinbase and its customers against some of the most sophisticated attackers in the world. This team - spanning CDRE, Insider Threat, Blockops and Threat Intelligence - protects billions of dollars in digital assets while scaling security coverage for the next billion crypto users. You'll own frontline incident response, build detection and automation capabilities, and partner across the organization to keep Coinbase safe as it launches new Web3 products globally.

Responsibilities

Own second-line triage and response for security alerts, leading incident management through resolution and driving post-incident improvements
Build and maintain runbooks for repeatable response patterns, then define and implement automation to eliminate manual toil
Partner with teams across Security Operations to develop monitoring strategies informed by attacker investigation findings
Drive Security monitoring and incident response for emerging Web3 product launches
Strengthen team capabilities by mentoring peers, sharing knowledge, and participating in 24/7 rotational coverage across time zones

Requirements

3+ years of hands-on security operations experience including incident response, alert triage, and network/host forensics across cloud, SaaS, and container environments
Demonstrated ability to identify detection gaps and build coverage across diverse log sources (cloud platforms, SaaS applications, container orchestration, M&A integrations)
Proficiency scripting automation workflows that reduce manual investigation and response time (Python, Bash, or equivalent)
Working knowledge of networking fundamentals and operating systems (Windows, Linux, macOS) sufficient to analyze host and network-level artifacts
Experience working with SIEM platforms and threat intelligence tooling at scale, including tuning alerts and improving signal-to-noise ratios
Utilizes generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality.