Senior Onchain Investigator & Threat Intelligence Lead

Matcha; Northern (KY); Hybrid; USD 180,000 - 212,000; Full time

Job summary

Coinbase is seeking a Senior Onchain Investigator to own end-to-end investigations against threat actors within the crypto ecosystem. You will cluster illicit wallets, fuse OSINT with onchain evidence, and translate findings into detections and actions protecting customers and products.

You will lead investigation methods, teach them across Security Operations, and collaborate with product, engineering, and risk teams to embed threat mitigations in the development lifecycle.

Qualifications

• 5+ years of investigations including 3+ years onchain illicit activity, with leadership.
• Deep knowledge of blockchain ecosystems, tracing across chains, bridges and laundering patterns.
• Proficient with Python or Go and SQL for data analysis and tooling.
• Track record of creating reusable investigation methods or pipelines.
• Ability to translate complex analysis into actionable intelligence for execs.
• Strong OSINT experience across diverse topics.

Responsibilities

• Own complex onchain investigations into threat actor infrastructure and abuse.
• Drive clustering and attribution using blockchain analytics and OSINT; operationalize results.
• Build OSINT and onchain analysis pipelines, queries and dashboards.
• Lead post-incident reviews and root cause analyses to improve controls.
• Collaborate with product, engineering, and risk teams to embed mitigations.
• Lead new investigative techniques and brief executives with clear risk insights.

Skills

Investigations

Onchain analysis

OSINT

Executive briefing

Stakeholder communication

Security operations

Tools

Python

Go

SQL

Job description

Coinbase is seeking a Senior Onchain Investigator to own end-to-end investigations against threat actors within the crypto ecosystem. You will cluster illicit wallets, fuse OSINT with onchain evidence, and translate findings into detections and actions protecting customers and products.

You will lead investigation methods, teach them across Security Operations, and collaborate with product, engineering, and risk teams to embed threat mitigations in the development lifecycle.