Threat Intelligence Platform Engineer
Posted Updated
- As a Threat Intelligence Platform Engineer on the Threat Intelligence team within Security Operations, you’ll own Vertex Synapse in production - the platform that turns adversary intelligence into detections, blocks, and decisions across Coinbase
- The TI team protects billions of dollars in digital assets by collecting, modeling, and operationalizing intelligence on the most sophisticated cyber threats targeting the crypto ecosystem
- You’ll keep the platform healthy, ingest and model new intelligence sources, and ship the automations that weave threat intelligence into the fabric of security operations at Coinbase
- Own the production Vertex Synapse instance, including platform health, backend operations, cron monitoring, and data hygiene
- Build and maintain intelligence feed integrations, enrichments, and tagging so new sources land modeled and usable by stakeholders
- Ship intelligence into downstream controls and data pipelines, including detections, blocklists, data warehouses, and agent workflows
- Partner across Security and Product to translate intelligence requirements into production capabilities
- Rapidly prototype and implement features, fixes, and tooling as required by the team’s Intelligence Analysts and stakeholders
- Experience ingesting, modeling, tagging, and lifecycle-managing indicators and related intelligence data at scale
- 2+ years building and operating threat intelligence platforms or security data pipelines in production environments
- Experience translating cross-functional stakeholder needs into technical solutions within a security operations context
- Utilizes generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality
- Track record of troubleshooting and restoring production systems and data quality issues, then driving root-cause fixes to prevent recurrence
- Software development experience in Python, Go, and/or Storm, including deploying production-quality code with CI/CD ownership after ship