Regional Threat Assessment Manager

About the role

You will own the full lifecycle of complex regional threat cases from initial intake through structured behavioral assessment, mitigation planning, and formal closure while safeguarding Coinbase employees, executives, facilities, and critical operations. You will serve as the regional subject matter expert and thought leader, elevating threat assessment standards and mentoring peers to strengthen the Protective Intelligence program. You will lead intelligence-driven incident response during active events, coordinating seamlessly with GSOC, Executive Protection, and cross-functional partners to ensure timely, evidence-based decisions. You will translate ambiguous, high-consequence information into clear risk rationales and actionable recommendations using established methodologies and frameworks. You will partner closely with Legal, HR/ER, Insider Threat, and Communications to align mitigations, manage reporting obligations, and maintain regulatory compliance across jurisdictions. You will produce concise, decision-ready briefings and executive updates that communicate threat posture, underlying drivers, and recommended next steps to security leadership and stakeholders.

Key facts

What you'll do

• Own end-to-end threat case management for your region, coordinating intake, triage, behavioral assessment, mitigation planning, documentation, and closure for risks affecting employees, executives, facilities, and Coinbase assets.
• Lead structured behavioral threat assessments using Coinbase methodologies and accepted frameworks such as JACA, WAVR-21, and CTAP-25 to evaluate motivation, capability, escalation indicators, and stabilizers, then translate findings into clear operational recommendations.
• Drive intelligence-led incident response by serving as the intelligence lead during active incidents, coordinating with GSOC, ensuring timely escalation, and delivering decision support from detection through resolution.
• Partner cross-functionally with Executive Protection, GSOC, Legal, HR/ER, Insider Threat, and Communications to coordinate response actions, align mitigations, and satisfy reporting obligations across regional requirements.
• Produce decision-ready briefings, written assessments, and executive updates that communicate threat posture, risk rationale, and recommended next steps to security leadership and cross-functional partners in a clear, actionable format.
• Strengthen regional program maturity by improving intake standards, quality control processes, playbooks, metrics, training content, and handoff procedures while mentoring peers through expertise and influence.
• Utilize case management and intelligence tools such as Ontic, OSINT platforms, public records research, and social media monitoring to refine investigations, increase signal quality, and streamline workflows.
• Apply generative AI responsibly with human oversight to deliver business-ready outputs that enhance workflow efficiency, reduce operational cost, and improve the quality of threat assessments.
• Coordinate with law enforcement and external stakeholders, manage investigative referrals, and navigate workplace violence reporting obligations across different jurisdictions in alignment with Coinbase policies.
• Maintain strict confidentiality and ethical standards when handling sensitive information, ensuring that all assessments and recommendations are based on factual evidence and professional judgment.
• Continuously monitor the threat landscape and emerging risks relevant to Coinbase operations, proactively identifying trends that could impact personnel, facilities, or digital assets.
• Collaborate with regional stakeholders to ensure that mitigation plans are practical, enforceable, and aligned with local legal, cultural, and operational constraints.

Requirements

• Bring 7+ years of progressively responsible experience in threat assessment and management, protective intelligence, workplace violence prevention, behavioral threat assessment, or closely related security functions.
• Demonstrate a track record of operating as a senior individual contributor and regional subject matter expert, independently owning ambiguous, high-consequence casework with limited oversight while influencing outcomes across teams without direct authority.
• Show proven ability to conduct thorough threat investigations and translate fragmented information into clear assessments, prioritized risks, and practical mitigation plans using structured professional judgment frameworks.
• Exhibit proficiency with case management and intelligence tools such as Ontic, OSINT platforms, public records research, and social media monitoring, with a history of improving processes and tooling to increase signal quality.
• Possess experience coordinating with law enforcement, managing investigative referrals, and navigating workplace violence reporting obligations across multiple jurisdictions.
• Apply generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality.
• Operate effectively in a remote-first environment while preparing for periodic in-person working sessions called "surges" that occur quarterly.
• Uphold Coinbase's mission of increasing economic freedom by adhering to the company's standards for integrity, compliance, and ethical conduct in all threat assessment activities.

Practical notes

• You will be based in a Remote
• Singapore role and are expected to attend quarterly in-person working sessions known as "surges."
• This is an at-will employment opportunity, and terms of engagement will be confirmed in source documentation.
• Applicants must comply with Coinbase policies, including confidentiality, ethical handling of sensitive information, and adherence to regional legal requirements.
• No additional compensation details are specified beyond the base salary range indicated in the pay transparency notice.
• Visa sponsorship details are not provided in the source material and should be confirmed during the hiring process if applicable.