Senior Threat Intelligence Engineer

Written by the T&S Network from Coinbase's posting.

Threat intelligence work inside Coinbase's Security Operations team, tracking sophisticated adversaries that target customers, employees, products and infrastructure at a crypto and financial company. The role turns internal and external signals into detections and intelligence briefs for stakeholders who make risk-based decisions, with the team's shared threat view kept in its Threat Intelligence Platform.

What you'd do

• Build automated pipelines that track and analyze advanced threats aimed at customers, staff, products and infrastructure.
• Report and present intelligence analysis to stakeholders, partners and executives to shape organizational decisions.
• Model and curate the shared threat view in Vertex Synapse, and peer review analysis with strategic feedback.
• Form ties with threat intel peer groups to gain more information and deepen mutual trust.
• Prioritize, document and deliver a high volume of intelligence requests with timely and accurate reporting.
• Serve as subject matter expert on current cyber threats facing Coinbase, crypto and the broader financial industry.

What it asks for

• Five-plus years of hands-on work in threat intel, incident response, security research or cyber investigations.
• Proficiency in at least one programming language, such as Python or Go, and SQL for analysis and tooling.
• Ability to turn complex technical threat analysis into clear briefs for technical and executive audiences.
• Track record of self-directed investigations and building solutions with minimal oversight.
• Open-source intelligence (OSINT) research skills across many subject areas.
• Responsible use of generative AI with human oversight to improve workflow efficiency, cost and quality.

Worth knowing

• Quarterly in-person working sessions called surges are expected.

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Coinbasenorth_east before you apply. If we got something wrong, report this listing.