Senior Analyst, Technology Risk

Overview

Ready to be pushed beyond what you think you’re capable of?

At Coinbase, our mission is to increase economic freedom in the world. It’s a massive, ambitious opportunity that demands the best of us, every day, as we build the emerging onchain platform — and with it, the future global financial system.

To achieve our mission, we’re seeking a very specific candidate. We want someone who is passionate about our mission and who believes in the power of crypto and blockchain technology to update the financial system. We want someone who is eager to leave their mark on the world, who relishes the pressure and privilege of working with high caliber colleagues, and who actively seeks feedback to keep leveling up.

We want someone who will run towards, not away from, solving the company’s hardest problems.

Our work culture is intense and isn’t for everyone. If you want to build the future alongside others who excel in their disciplines and expect the same from you, there’s no better place to be.

While many roles at Coinbase are remote-first, we are not remote-only. In-person participation is required throughout the year. Team and company-wide offsites are held multiple times annually to foster collaboration, connection, and alignment. Attendance is expected and fully supported.

• Senior Analyst of Technology Risk on the Coinbase Technology Risk & Controls team; support the implementation and maturity of the technology and security risk management program. Define, quantify, manage, and communicate risks; use outcomes to inform business decisions. Serve as the subject matter expert in technology risk management operations for fast-moving technical teams across global time zones.

• Analysis of variables, including threat intelligence and risks, to inform threat models and risk scoring methodologies.

• Enable risk-informed business outcomes by communicating quantitative and qualitative tradeoffs to teams and leadership.

• Manage risks throughout the risk lifecycle: intake, triage, analyze, and calculate inherent/residual risk with risk owners; document risk treatment decisions and validate mitigation plans; participate in continuous monitoring.

• Reporting on risk posture: support ongoing reporting on findings, metrics, and mitigations to leadership; participate in meetings with leadership and risk owners.

• Maintain source of truth risk register: data quality, tooling support, and automation/process improvements to improve risk management data and tooling.

• Communications and training: support development and maintenance of communication and training plans to roll out the technology risk program; maintain runbooks, intranet pages, and risk register dashboards.

• Enterprise risk alignment: work with Enterprise Risk Management to escalate risks and report metrics to senior leadership as needed.

• Global engagement: collaborate with stakeholders to scale the program across Coinbase entities, products, and geographies; work with GRC, Legal, and Compliance for risks and regulatory reporting.

• Support audit and regulatory inspections: assist in data compilation for US and international inquiries.

• Maintain awareness of international regulation, emerging threats, forecasts, policies, and benchmarks.

• Execute technical risk assessments across production and corporate environments; communicate risk in qualitative and quantitative terms.

• 5+ years of experience in a 1 or 2 LoD risk management function and/or Governance, Risk, and Compliance organization.

• Risk domain knowledge and best practices: familiarity with standards and frameworks such as ISO 27001/5, NIST CSF, COBIT, ITIL, DORA, FAIR risk methodology.

• Technology risk domain knowledge: ability to perform technical quantitative risk assessments across IT domains (asset management, resilience, SDLC, infrastructure).

• Experience with project management tools (e.g., Jira, Archer) and analytics tooling.

• Clear and concise written and spoken communication; ability to translate controls and risk standards into actionable requirements for varied stakeholders.

• Regulatory familiarity: knowledge of major regulatory/legal frameworks affecting technology organizations.

• Ability…