Remote Senior Onchain Threat Investigator

Coinbase, Inc.; Cheyenne (WY); Hybrid; USD 180,000 - 212,000; Full time

Job summary

Coinbase, Inc. is seeking a Senior Onchain Investigator to own end-to-end onchain investigations, clustering illicit wallets, and turning findings into detections and actions that protect customers and products.

You will lead investigation methodology for the team and collaborate across security, product, and risk teams. The role requires 5+ years of investigations, deep blockchain knowledge, and proficiency in Python/Go and SQL.

Qualifications

• 5+ years of investigations, incl. 3+ years onchain activity, with independent leadership.
• Deep knowledge of blockchain ecosystems, tracing, bridges, and laundering patterns.
• Proficiency in Python or Go and SQL for data analysis and tooling.
• Track record of building reusable investigation methods, dashboards, or pipelines.
• Ability to translate complex technical analysis into actionable intel for diverse stakeholders.
• OSINT expertise across a wide range of topics.
• Responsible use of generative AI with human oversight.

Responsibilities

• Own complex onchain investigations into threat actor infrastructure and abuse.
• Cluster illicit actors with blockchain analytics and OSINT; operationalize results.
• Build OSINT and onchain analysis pipelines, queries, and dashboards.
• Lead post-incident reviews to identify gaps and enhance controls and detection.
• Partner with product, engineering, and risk teams to embed threat mitigation in lifecycle.
• Lead new techniques and brief executives with clear risk and actions.

Skills

Investigations

Onchain analytics

Blockchain knowledge

Python/Go

SQL

Investigation workflows

OSINT

Executive briefings

AI in security

Tools

Python

Go

Job description

Coinbase, Inc. is seeking a Senior Onchain Investigator to own end-to-end onchain investigations, clustering illicit wallets, and turning findings into detections and actions that protect customers and products.

You will lead investigation methodology for the team and collaborate across security, product, and risk teams. The role requires 5+ years of investigations, deep blockchain knowledge, and proficiency in Python/Go and SQL.