Senior Onchain Investigator

Written by the T&S Network from Coinbase's posting.

Onchain investigations inside Coinbase's Threat Intelligence team, within Security Operations, targeting threat actors, scam networks, and exploits aimed at Coinbase and Base. The work clusters illicit wallets, fuses OSINT with onchain evidence, and turns findings into detections and blocks that protect customers and products.

• Fraud and scams

What you'd do

• Lead end-to-end probes of threat actor setups, fraud rings, and exploit activity hitting Coinbase and Base
• Attribute illicit actors by combining chain analytics, open-source research, and internal records, then feed findings into Synapse and downstream controls
• Create analysis scripts, queries, and dashboards that automate detection and expand what the team can handle
• Run post-incident reviews and root cause work, then suggest fixes to controls, detection, and security posture
• Work with product, engineering, and risk teams to bake abuse mitigation into development from concept through launch
• Invent new investigative methods, train colleagues across Security, and give executives the risk picture and next steps

What it asks for

• 5+ years of investigations, including 3+ years on onchain illicit activity, crypto abuse, or blockchain intelligence
• Strong grasp of blockchain protocols, following funds across chains, bridges, mixers, and laundering patterns
• Proficient in Python or Go and SQL for analysis, scripting, and tooling
• Skilled at OSINT research across a wide range of topics
• Ability to explain technical analysis to technical and non-technical audiences, including executives

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Coinbasenorth_east before you apply. If we got something wrong, report this listing.