Specialist, CSIRT

Coinbase
India
Remote

Who this role is best for

Strong fit for security professionals who automate incident response and collaborate across teams, with experience in cloud and container environments and a preference for remote work with periodic in-person surges.

Best fit for

  • Candidates with incident response experience and a track record of building automation workflows in cloud and container environments
    — “Build and maintain runbooks for repeatable response patterns, then define and implement automation to eliminate manual toil
  • Individuals who thrive in remote-first settings with periodic in-person collaboration
    — “remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges”
  • Professionals who can mentor peers and contribute to team-wide 24/7 coverage
    — “Strengthen team capabilities by mentoring peers, sharing knowledge, and participating in 24/7 rotational coverage across time zones

Things to consider

  • The role demands working with diverse log sources and large-scale SIEM platforms
    — “Demonstrated ability to identify detection gaps and build coverage across diverse log sources

How to stand out

  • Emphasize your ability to work with cloud platforms, SaaS applications, and container orchestration
    — “Demonstrated ability to identify detection gaps and build coverage across diverse log sources (cloud platforms, SaaS applications, container orchestration, M&A integrations)
  • Showcase your SIEM platform tuning and signal-to-noise ratio improvement capabilities
    — “Experience working with SIEM platforms and threat intelligence tooling at scale, including tuning alerts and improving signal-to-noise ratios
  • Demonstrate responsible use of generative AI to improve workflow efficiency and quality
    — “Utilizes generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality.
Pace · Fast PacedCollaboration · HighAutonomy · HighDecision Impact · TeamLevel · Mid Level

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

  • security alerts triage and response
  • incident management
  • automation implementation
  • monitoring strategies
  • security monitoring
Typical background
security operationsincident response

Skills & requirements

Required

Incident ResponseAlert TriageNetwork/host ForensicsAutomationMonitoring StrategiesSecurity OperationsSIEM PlatformsThreat IntelligenceScriptingNetworking FundamentalsOperating Systems

Preferred

Generative AI

Stack & domain

Security OperationsIncident ResponseAlert TriageNetwork/host ForensicsCloudSaasContainer EnvironmentsScriptingPythonBashNetworking FundamentalsOperating SystemsSIEM PlatformsThreat IntelligenceGenerative AITeamworkProblem SolvingCritical ThinkingCommunicationMentoringKnowledge Sharing24/7 Rotational CoverageCybersecurityCloud SecurityNetwork SecurityHost SecuritySIEM

About the role

Original posting from Coinbase

Ready to do the most impactful work of your career? At Coinbase, we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase.

As a Security Operations Specialist on the Security Operations team, you'll defend Coinbase and its customers against some of the most sophisticated attackers in the world. This team - spanning CDRE, Insider Threat, Blockops and Threat Intelligence - protects billions of dollars in digital assets while scaling security coverage for the next billion crypto users. You'll own frontline incident response, build detection and automation capabilities, and partner across the organization to keep Coinbase safe as it launches new Web3 products globally.

What you'll do:

Own second-line triage and response for security alerts, leading incident management through resolution and driving post-incident improvements

Build and maintain runbooks for repeatable response patterns, then define and implement automation to eliminate manual toil

Partner with teams across Security Operations to develop monitoring strategies informed by attacker investigation findings

Drive Security monitoring and incident response for emerging Web3 product launches

Strengthen team capabilities by mentoring peers, sharing knowledge, and participating in 24/7 rotational coverage across time zones

Required Skills and Experience:

3+ years of hands-on security operations experience including incident response, alert triage, and network/host forensics across cloud, SaaS, and container environments

Demonstrated ability to identify detection gaps and build coverage across diverse log sources (cloud platforms, SaaS applications, container orchestration, M&A integrations)

Proficiency scripting automation workflows that reduce manual investigation and response time (Python, Bash, or equivalent)

Working knowledge of networking fundamentals and operating systems (Windows, Linux, macOS) sufficient to analyze host and network-level artifacts

Experience working with SIEM platforms and threat intelligence tooling at scale, including tuning alerts and improving signal-to-noise ratios

Utilizes generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality.

Position ID:  P77687

#LI-Remote

Pay Transparency Notice: The target annual base salary for this position can range as detailed below. Total compensation may also include equity and bonus eligibility and benefits (including medical, dental, and vision).

Annual base salary range (excluding equity and bonus):₹2,755,300—₹2,755,300 INR

Application Limit: Candidates may submit a maximum of 3 applications within a 6-month period.

Equal Opportunity Employer: Coinbase is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or genetic information. Applicants with criminal histories will be considered consistent with applicable federal, state, and local laws.

US Applicants: View Employee Rights, Know Your Rights, and E-Verify Notice of Participation.

Accommodations: If you are an individual with a disability who needs a reasonable accommodation, email us your request and contact info at accommodations[at]coinbase.com. Need screen reading technology? Click here to download a free compatible screen reader and view the tutorial.

Data Privacy & Arbitration: By submitting your application, you agree to our Candidate Privacy Notice. US applicants: By submitting your application, you agree to Arbitration of Disputes.

Source: Coinbase careers

Similar roles