Senior Onchain Investigator - Remote Threat Intelligence

Triwill Group; Northern (KY); Hybrid; USD 180,000 - 212,000; Full time

Job summary

Coinbase's Threat Intelligence team seeks a Senior Onchain Investigator to own end-to-end onchain investigations into threat actors targeting the crypto ecosystem, clustering illicit wallets and turning findings into detections and actions. You will build OSINT and onchain pipelines, lead post-incident reviews, and partner with product, engineering, and risk teams to embed mitigation strategies throughout the product lifecycle.

Remote-friendly with quarterly in-person surges.

Qualifications

• 5+ years of investigations, including 3+ years onchain activity.
• Deep knowledge of blockchain ecosystems and protocols.
• Proficient with Python or Go and SQL for data analysis and tooling.
• Track record of creating methods, dashboards, or pipelines adopted by others.
• Ability to translate complex technical analysis into actionable intelligence for stakeholders, including executives.
• OSINT experience across a wide range of topics.
• Responsible use of generative AI with human oversight.

Responsibilities

• Own complex onchain investigations into threat actor infrastructure, scam networks, exploits, and related abuse targeting Coinbase and Base.
• Drive clustering and attribution of illicit actors using blockchain analytics, OSINT, and internal data, then operationalize results.
• Build OSINT and onchain analysis pipelines, queries, and dashboards that automate detections and scale investigations.
• Lead post-incident reviews and root cause analyses to improve controls and overall security posture.
• Partner with product, engineering, and risk teams to embed threat mitigation in the product lifecycle from ideation to launch.
• Lead new investigative techniques and brief executives with clear risk, impact, and actions.

Skills

Onchain investigations

Blockchain analytics

OSINT

Python

Go

SQL

Tools

Python

Go

SQL

Blockchain analytics

Job description

Coinbase's Threat Intelligence team seeks a Senior Onchain Investigator to own end-to-end onchain investigations into threat actors targeting the crypto ecosystem, clustering illicit wallets and turning findings into detections and actions. You will build OSINT and onchain pipelines, lead post-incident reviews, and partner with product, engineering, and risk teams to embed mitigation strategies throughout the product lifecycle.

Remote-friendly with quarterly in-person surges.