The Global Intelligence team serves as advocates for the crypto-economy and guardians for Coinbase, dedicated to preventing and addressing criminal activity. Acting as liaison between law enforcement and Coinbase, the team handles criminal matters on the platform through proactive and reactive investigations.

We are seeking a seasoned Cyber Investigation Specialist with deep expertise in cyber-enabled crime. The ideal candidate will leverage advanced cyber investigation techniques combined with blockchain analysis to trace illicit funds, support victim recovery, and assist law enforcement in disrupting criminal activity in the crypto space.
This role will also contribute to training law enforcement on crypto-crime investigation methodologies and advising on internal tool development to enhance our investigative capabilities.

We're looking for someone who thrives in complex, fast-paced investigations—uncovering hidden connections, analyzing threat actor TTPs, and piecing together intricate digital evidence. If you're hungry for a challenge, eager to make a significant impact on a small team, and passionate about protecting the integrity of the crypto ecosystem, we want to hear from you.

What you’ll be doing (ie. job duties):

Independently conduct complex investigations into various cases such as account takeovers, investment scams, and other potential illegal activities on the platform.
This includes identifying threat actors and working to recover funds for victims;
Remain current with crypto industry developments and landscape, keeping up-to-date about new threat actor TTPs, network protocols, and applicable regulation;
Prepare detailed written intelligence reports and briefing decks for law enforcement to communicate investigative findings;
Handle highly sensitive cases with urgency and discretion;
Master evolving investigative tools for blockchain analytics, social media platforms with emphasis on identity research, data extraction and analysis;
Lead quarterly sprints on emerging threats and topical concerns;
Occasionally respond to law enforcement requests and inquiries;
Occasional domestic and foreign travel, providing trainings to law enforcement and representing the team at significant and high-priority conferences and meetings;
Provide guidance, feedback and support to more junior investigators as they handle their own cases.

What we look for in you (ie. job requirements):

4+ years of experience investigating cybercrime and financial crimes, preferably at financial institutions or technology companies;
Proven experience in the cyber threat landscape with demonstrated ability to respond rapidly to threat incidents and implement preventative mitigation strategies
Good understanding conducting blockchain analysis, transaction tracing, and identifying complex obfuscation techniques (e.g., mixers, chain-hopping)
Hands-on experience investigating illicit activity including ransomware attacks, account takeovers, fraud/theft, narcotics trafficking, Child Sexual Abuse Material (CSAM), and Terror Financing (TF)
Strong data analysis skills with proficiency in SQL and spreadsheet tools (e.g., pivot tables, data visualization)
Expertise in Open Source Intelligence (OSINT) techniques and public records research
Excellent written and verbal communication skills with the ability to distill complex technical concepts for non-technical stakeholders
Strong organizational and time management skills with the ability to prioritize competing demands and manage multiple investigations simultaneously
Experience collaborating cross-functionally with legal, compliance, law enforcement, and product teams on sensitive investigations

Nice to haves:

Foreign language skills;
One or more of the following certifications: CRC, CISC, CEIC, TRM-CI, TRM-ACI or other relevant certifications;
Experience working in or with law enforcement;
Facility in Python or other languages;
Proficiency in Dune.

Req ID: P75921

#LI-Remote