Remote Security Operations: Incident Response & Automation

Coinbase Bridge; United States; Remote; USD 26,000 - 32,000; Full time

Job summary

Coinbase is seeking a Security Operations Specialist to defend against sophisticated attackers and protect customers as Web3 products launch globally. You will own frontline incident response, build automation, and shape monitoring strategies across a 24/7 rotating schedule.

You will work with teams across Security Operations, use SIEMs and threat intel tooling, and mentor peers while handling second-line triage for alerts.

Qualifications

• 3+ years of hands-on security operations including incident response and alert triage.
• Experience across cloud, SaaS, and container environments.
• Ability to script automation to reduce investigation time.
• Working knowledge of Windows, Linux, macOS OS.
• Experience with SIEM platforms and threat intel tooling.
• Responsible use of generative AI with human oversight.

Responsibilities

• Own second-line triage and response for security alerts, leading incident management through resolution.
• Build and maintain runbooks and automate repeatable response patterns.
• Partner with Security Operations teams to develop monitoring strategies.
• Drive monitoring and incident response for new Web3 product launches.
• Mentor peers and support 24/7 coverage across time zones.

Skills

Incident response

Log analysis

Scripting (Python/Bash)

Networking fundamentals

SIEM experience

Threat intel tooling

Tools

SIEM platforms

Job description

Coinbase is seeking a Security Operations Specialist to defend against sophisticated attackers and protect customers as Web3 products launch globally. You will own frontline incident response, build automation, and shape monitoring strategies across a 24/7 rotating schedule.

You will work with teams across Security Operations, use SIEMs and threat intel tooling, and mentor peers while handling second-line triage for alerts.