Senior Onchain Investigator — Remote Threat Intelligence Lead

Coinbase; Northern (KY); On-site; USD 180,000 - 212,000; Full time

Job summary

Coinbase is seeking a Senior Onchain Investigator to own end-to-end onchain investigations, applying blockchain analytics, OSINT, and internal data to detect and block abuse across the crypto ecosystem. You will shape investigation methodology and work with cross-functional teams to protect customers and products.

The role requires 5+ years of investigations (3+ onchain), deep blockchain knowledge, and proficiency in Python/Go and SQL. This is a remote-first role with quarterly in-person surges.

Qualifications

• 5+ years of investigations, including 3+ years onchain illicit activity
• Deep knowledge of blockchain ecosystems and protocols
• Proficient with Python or Go and SQL for data analysis
• Track record of creating investigation methods, dashboards, or pipelines
• Ability to translate complex technical analysis into actionable intelligence for technical and non-technical stakeholders
• Skilled in conducting open-source intelligence (OSINT) research

Responsibilities

• Own complex onchain investigations into threat actor infrastructure, scam networks, exploits, and related abuse targeting Coinbase and Base
• Drive clustering and attribution of illicit actors using blockchain analytics, OSINT, and internal data
• Build OSINT and onchain analysis pipelines, queries, and dashboards that automate detections and scale investigative capacity
• Lead post-incident reviews and root cause analyses to identify gaps and improve controls and detection
• Partner with product, engineering, and risk teams to embed threat mitigation in the product lifecycle
• Lead new investigative techniques and brief executives with clear risk and actions

Skills

Onchain investigations

Blockchain analytics

Python

Go

SQL

OSINT

Job description

Coinbase is seeking a Senior Onchain Investigator to own end-to-end onchain investigations, applying blockchain analytics, OSINT, and internal data to detect and block abuse across the crypto ecosystem. You will shape investigation methodology and work with cross-functional teams to protect customers and products.

The role requires 5+ years of investigations (3+ onchain), deep blockchain knowledge, and proficiency in Python/Go and SQL. This is a remote-first role with quarterly in-person surges.