Specialist, CSIRT
Core
Defend Coinbase and its customers against sophisticated attackers by owning frontline incident response, building detection capabilities, and automating security operations for Web3 products.
Role type
Senior IC security operations specialist (incident response & automation)
Builds
Detection and automation capabilities for security monitoring and incident response
Domain
Cybersecurity, Web3, Cloud Security
Deliverable
production ML models | product features | dashboards & analysis | infrastructure
Required skills
Incident response, alert triage, network/host forensics, scripting automation (Python/Bash), SIEM tuning, threat intelligence tooling, cloud/SaaS/container environment experience
Preferred skills
Generative AI integration for workflow efficiency
Technologies
Python, Bash, SIEM platforms, cloud platforms, SaaS applications, container orchestration, Windows, Linux, macOS
Responsibilities
Own second-line triage and response for security alerts, build and maintain runbooks for repeatable response patterns, partner with teams to develop monitoring strategies, drive security monitoring for emerging Web3 product launches, mentor peers and participate in 24/7 rotational coverage
Seniority
Senior, hands-on IC
