Senior Onchain Investigator — Remote Threat Intel Lead

Coinbase, Inc.; Juneau (AK); Remote; USD 180,000 - 212,000; Full time

Job summary

Coinbase, Inc. is seeking a Senior Onchain Investigator to own end-to-end onchain investigations into threat actors targeting Coinbase and the crypto ecosystem.

You will cluster illicit wallets, fuse OSINT with onchain evidence, and turn findings into detections, blocks, and decisions that protect customers and products. This role leads investigation methodology for the team, partners with product, engineering, and risk to embed threat mitigation into the lifecycle from ideation to launch, and

Qualifications

• 5+ years of investigations with 3+ years onchain activity or blockchain intel.
• Proven ability to lead investigations from collection through stakeholder action.
• Deep knowledge of blockchain ecosystems, tracing across chains and mixers.
• Ability to translate technical analysis into actionable intelligence for executives.
• Strong OSINT capabilities and experience with threat actor profiling.
• Experience building methods, dashboards, or pipelines adopted by others.
• Responsible use of AI with human oversight to improve workflows.

Responsibilities

• Own complex onchain investigations into threat actor infrastructure and abuse.
• Drive clustering and attribution of illicit actors using analytics and OSINT.
• Build OSINT and onchain analysis pipelines and dashboards to automate detections.
• Lead post-incident reviews and recommend controls improvements.
• Partner with product, engineering, and risk teams to embed mitigations.
• Lead new investigative techniques and brief executives with risk insights.

Skills

Investigation leadership

Blockchain tracing

Stakeholder communication

OSINT research

Analytical reporting

Independent investigations

Policy and process improvement

Tools

Python

Go

SQL

Job description

Coinbase, Inc. is seeking a Senior Onchain Investigator to own end-to-end onchain investigations into threat actors targeting Coinbase and the crypto ecosystem.

You will cluster illicit wallets, fuse OSINT with onchain evidence, and turn findings into detections, blocks, and decisions that protect customers and products. This role leads investigation methodology for the team, partners with product, engineering, and risk to embed threat mitigation into the lifecycle from ideation to launch, and