Threat Intelligence Platform Engineer

at Coinbase

📍 United States

USD 144,500-170,000 per year

MIDDLE

✅ Remote

Tech Stack
Tag name is followed by "@" symbol and proficiency level value. About proficiency levels:

1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;

3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;

7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;

10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.

AI @ 3 CI/CD @ 3 Data Pipelines @ 3 GenAI Generative AI @ 3 Go @ 3 Python @ 3 Security @ 3 Software Development @ 3

Details

Coinbase is a remote-first, but not remote-only company, with quarterly in-person working sessions called “surges.” As a Threat Intelligence Platform Engineer on the Threat Intelligence team within Security Operations, you will own Vertex Synapse in production—the platform that turns adversary intelligence into detections, blocks, and decisions across Coinbase. The team protects digital assets by collecting, modeling, and operationalizing intelligence on cyber threats targeting the crypto ecosystem.

Responsibilities

Own the production Vertex Synapse instance, including platform health, backend operations, cron monitoring, and data hygiene.
Build and maintain intelligence feed integrations, enrichments, and tagging so new sources are modeled and usable by stakeholders.
Ship intelligence into downstream controls and data pipelines, including detections, blocklists, data warehouses, and agent workflows.
Partner across Security and Product to translate intelligence requirements into production capabilities.
Rapidly prototype and implement features, fixes, and tooling for Intelligence Analysts and stakeholders.

Requirements

2+ years of experience building and operating threat intelligence platforms or security data pipelines in production environments.
Software development experience in Python, Go, and/or Storm, including deploying production-quality code and owning CI/CD after release.
Experience ingesting, modeling, tagging, and lifecycle-managing indicators and related intelligence data at scale.
A track record of troubleshooting and restoring production systems and data quality issues, followed by implementing root-cause fixes to prevent recurrence.
Experience translating cross-functional stakeholder needs into technical solutions within a security operations context.
Ability to use generative AI responsibly, maintain human oversight, and deliver business-ready outputs that improve workflow efficiency, cost, and quality.

Compensation

The annual base salary range is $144,500–$170,000 USD, excluding equity and bonus. Total compensation may also include equity, bonus eligibility, and medical, dental, vision, and 401(k) benefits.