Insider Threat Analyst

Role Overview

You’ll join Coinbase’s Insider Threat team within Security Operations. The team protects billions of dollars in digital assets and the trust of millions of customers by detecting, investigating, and mitigating threats originating from within the organization.

What You’ll Do

• Perform alert triage, correlation, and analysis across insider threat systems including SIEM, UBA, DLP, and endpoint detection.
• Support end-to-end investigations, from evidence collection through employee interviews and stakeholder coordination.
• Partner with Security, Legal, HR, and business teams to design and execute processes that identify and mitigate insider risks (including abuse/misuse across company systems).
• Create case documentation and investigative reports that convert technical findings into concise, decision-ready briefs for leadership.
• Improve insider threat detection by identifying control gaps, refining alerting logic, and recommending scalable solutions.

Required Skills & Experience

• 2+ years in insider threat, security operations, investigations, fraud detection, or a closely related area.
• Hands-on experience with insider threat technologies (SIEM, UBA, DLP, endpoint detection) and log analysis.
• Experience conducting or supporting investigations involving sensitive employee matters, including evidence collection, interviewing, and stakeholder coordination.
• Ability to translate complex security problems into actionable recommendations and leadership-ready investigative briefs.
• Knowledge of insider threat considerations, including legal/regulatory/ethical handling of sensitive information.
• Working knowledge of customer service tools or financial analysis.
• Responsible use of generative AI, with human oversight to produce business-ready outputs and measurable improvements in efficiency, cost, and quality.

Compensation

• Base salary range (annual, excluding equity/bonus): $135,320 — $159,200 USD
• Total compensation may include equity and bonus, plus benefits (medical/dental/vision/401(k)).

Location / Work Model

• Remote - USA Ready (remote-first; quarterly in-person “surges”).