Security Operations Specialist (CSIRT)

About the role

Ready to defend Coinbase and its customers against sophisticated attackers, you will join the Security Operations team that protects billions of dollars in digital assets and scales security for the next billion crypto users.

Key responsibilities

• Own second‑line triage and response for security alerts, leading incident management through resolution and driving post‑incident improvements.
• Build and maintain runbooks for repeatable response patterns and implement automation to eliminate manual toil.
• Partner with cross‑functional teams to develop monitoring strategies informed by attacker investigation findings.
• Drive security monitoring and incident response for emerging Web3 product launches.
• Mentor peers, share knowledge, and participate in 24/7 rotational coverage across time zones.

Required profile

• 3+ years of hands‑on security operations experience, including incident response, alert triage, and network/host forensics in cloud, SaaS, and container environments.
• Proven ability to identify detection gaps and build coverage across diverse log sources such as cloud platforms, SaaS applications, and container orchestration.
• Experience scripting automation workflows (Python, Bash or equivalent) to reduce investigation and response time.
• Working knowledge of networking fundamentals and operating systems (Windows, Linux, macOS) for analyzing host and network artifacts.
• Experience with SIEM platforms and threat‑intelligence tooling at scale, including alert tuning and signal‑to‑noise improvement.

Required skills

• Python
• Bash
• SIEM platforms
• Threat‑intelligence tooling
• Cloud platforms (e.g., AWS, GCP)
• SaaS applications
• Container orchestration (e.g., Kubernetes)
• Networking fundamentals
• Windows, Linux, macOS operating systems