Security Operations Specialist – Incident Response

About the role

As a Security Operations Specialist on Coinbase’s CSIRT team, you will protect the platform and its users from sophisticated cyber threats. Working in a remote‑first environment with quarterly in‑person surges, you will lead incident response, build detection automation, and collaborate across security functions to keep the crypto ecosystem safe.

Key responsibilities

• Own second‑line triage and response for security alerts, managing incidents from detection through resolution.
• Develop and maintain runbooks for repeatable response patterns and automate manual tasks.
• Partner with security teams to design monitoring strategies based on attacker investigations.
• Drive security monitoring and incident response for new Web3 product launches.
• Mentor peers, share knowledge, and participate in 24/7 rotational coverage across time zones.

Required profile

• 3+ years of hands‑on security operations experience, including incident response, alert triage, and network/host forensics.
• Proven ability to identify detection gaps and implement coverage across diverse log sources.
• Experience with cloud, SaaS, and container environments.

Required skills

• Python scripting (or Bash) for automation workflows.
• Working knowledge of networking fundamentals and operating systems (Windows, Linux, macOS).
• Proficiency with SIEM platforms and threat‑intelligence tooling at scale.
• Familiarity with cloud platforms, SaaS applications, and container orchestration logs.
• Responsible use of generative AI to enhance workflow efficiency.

What we offer

• Opportunity to work on high‑impact security challenges in the crypto and Web3 space.
• Remote‑first flexibility with quarterly collaborative surges.
• Competitive compensation, equity, and comprehensive benefits.