Security Ops Specialist - Incident Response & Automation

Coinbase; Indiana (PA); Hybrid; USD 26,000 - 32,000; Full time

Job summary

Coinbase is seeking a Security Operations Specialist to defend digital assets and scale protections as we launch new Web3 products globally. You’ll own frontline incident response, build automation, and partner across teams to reduce risk in a fast-paced, high-signal environment.

You’ll collaborate with CDRE, Insider Threat, Blockops and Threat Intelligence, mentoring peers and delivering measurable improvements in workflow efficiency and security coverage across time zones.

Qualifications

• 3+ years in security operations with incident response
• Experience with log sources across cloud, SaaS, containers
• Scripting to automate investigations (Python, Bash)
• Networking and OS basics (Windows/Linux/macOS)

Responsibilities

• Own second-line triage and response for security alerts, leading incident management through resolution and driving post-incident improvements
• Build and maintain runbooks for repeatable response patterns, then define and implement automation to eliminate manual toil
• Partner with teams across Security Operations to develop monitoring strategies informed by attacker investigation findings
• Drive Security monitoring and incident response for emerging Web3 product launches
• Strengthen team capabilities by mentoring peers, sharing knowledge, and participating in 24/7 rotational coverage across time zones

Skills

Incident response

Triage

Automation scripting

Python

Bash

Windows

Linux

macOS

SIEM

Threat intel

Tools

SIEM platforms

Threat intelligence tooling

Job description

Coinbase is seeking a Security Operations Specialist to defend digital assets and scale protections as we launch new Web3 products globally. You’ll own frontline incident response, build automation, and partner across teams to reduce risk in a fast-paced, high-signal environment.

You’ll collaborate with CDRE, Insider Threat, Blockops and Threat Intelligence, mentoring peers and delivering measurable improvements in workflow efficiency and security coverage across time zones.