NASDAQ: COIN · PUBLIC · Coinbase

Product Security Engineer

Offensive security on Coinbase's application-security team, including AI-assisted discovery. A product attacker, not a protocol researcher. The posting says Remote - Canada.

You are deciding whether to join a profitable-on-average, loss-making-this-quarter public company, on a named internal platform, with liquid stock and a headcount that has already been cut once in 2026.

Blockchain Lab analysis, for a candidate deciding whether to apply. We are not the employer. Compensation on this posting: Not disclosed.

Listing age

8 days

Equity

Listed stock

FY2025 revenue

$7.18 billion

Where

Remote - Canada

Status: Open on the employer board — checked 2026-10-06
Board updated: 2026-09-28 · 8 days before this check
Location: Remote - Canada
Remote eligibility: Remote - Canada
Employment: Not disclosed
Compensation: Not disclosed
Experience, as stored: Product security / offensive security. Compensation is not in the public feed.
Original post date: Not disclosed

Apply on the employer site The company Practice project

This seat

Blockchain Lab analysis

Finding vulnerabilities in Coinbase's products before someone else does, and writing them so a team can fix and retest.

It does not own L1 research, and it is not a U.S. remote seat. Canada is the employer's line. Do not apply from the wrong country and negotiate later.

The employer frames AI-assisted discovery as part of the work. That is a method, not the job. The job is still a vulnerability that is real, reproduced, and fixed. A model that files noise will make you slower.

Coinbase's June 2026 quarter lost money. Security hiring that survives a soft quarter is usually tied to something that scared someone. Ask, carefully, what changed. You may not get the incident. You should get the scope.

Updated 28 September 2026. Fresh. Compensation not disclosed, same as every other role on this desk.

The company you would actually join

Blockchain Lab analysis

Public reporting and the employer’s own releases. Not a relationship with Blockchain Lab. Not a credit opinion.

Founded: 2012, by Brian Armstrong and Fred Ehrsam.
Base: Remote-first. The corporate address used on filings is One Madison Avenue, Suite 2400, New York. Reincorporated from Delaware to Texas, stockholder consent 4 November 2025.
Status: Public since the 14 April 2021 direct listing. About 4,951 full-time employees as of the 31 December 2025 figure carried on Yahoo Finance.
People: Brian Armstrong, co-founder, chairman and CEO. Emilie Choi, president and COO. Alesia Haas, CFO. Fred Ehrsam remains a director. He co-founded Paradigm and is not the operator.

Coinbase is the cleanest company on this desk to underwrite, and it is still a cyclical. Fiscal 2025 did $7.18 billion of revenue and roughly $1.26 billion of net income. The quarter ended June 2026 did $1.22 billion and lost about $359 million. If your offer assumes last year's bonus, read this year's quarter. Trading is no longer 90 percent of the story, which is why these roles exist: networks, nodes, wallets, wrapped assets such as cbBTC, and fiat payments rails are internal platforms with their own on-call, not features of the candle chart.

The corporate form changed. Stockholders acted by written consent on 4 November 2025 to reincorporate from Delaware to Texas. The company describes itself as remote-first and, in some 2026 descriptions, as having no headquarters. That is not the same as 'anyone, anywhere'. Every role stored here says Remote - USA except Product Security, which says Remote - Canada. Those words are the eligibility constraint. A London candidate should not apply to them and hope.

Secondary coverage in 2026 described a workforce reduction of about 14 percent, on the order of 700 people, in May 2026. We did not re-derive that from a filing in this pass. Ask the recruiter whether the team you would join was touched, and what the current on-call load is. Public-company equity is the compensation fact the postings refuse to quantify: bands were not disclosed. None of the six roles states a salary. Do not invent one from levels.fyi in your head and then negotiate against a rumour.

Founders

Brian Armstrong

Co-founder, chairman, CEO

Born 1983. Has run Coinbase since founding. FY2025 reported pay was about $9.71 million, with a much larger exercised-equity figure beside it. The company still concentrates voting power in Class B stock. You are joining his instrument.

Fred Ehrsam

Co-founder and director

Born 1989. Left day-to-day work years ago and built Paradigm. He still files as a director and still sells stock on preset plans. Do not expect him in your design review. Do expect his votes to matter.

What the company sells

Trading

Still the cycle. The share of net revenue from trading has fallen from the 2021 extreme, but a quiet quarter still shows up as a loss.

Subscription and services

Custody, staking, USDC economics, Coinbase One, and prime. This is the line management wants you to believe is the company.

Base and platform engineering

The layer-2 launched in 2023, plus internal blockchain platform teams: networks, nodes, wallets, wrapped assets, payments. The roles on this desk sit here, not on the consumer growth squad.

Capital

FY2025 revenue

$7.18 billion

About +9% on FY2024. Standardised from filings.

FY2025 net income

About $1.26 billion

A real profit year. Not a promise about 2026.

Q2 2026

$1.22 billion revenue, about −$359 million net

Quarter ended June 2026. The cycle is not over.

Market cap

Near $50 billion

About $189 a share on 6 Oct 2026. 52-week range has been wide.

2012–2021
Venture, then a direct listing
About $86 billion at the 14 April 2021 debut
No new shares were sold in the listing. The reference print and the first trade were not the same number; debut valuations reported in the press clustered from the high tens of billions to around $100 billion depending on the print. Equity raised before the listing is a separate, smaller figure. The company later issued convertible debt, including a May 2021 offering.
2023–2025
Operating era, not a round
Public equity
Base launched in 2023. Coverage in 2025 described the SEC case as dropped, an S&P 500 inclusion, a MiCA permission, and the Deribit acquisition. Confirm each in the filing that matters to your team. They are not one event.

What should change your mind

Cycle. A down quarter cuts the narrative, the bonus, and sometimes the team.
Regulation remains a business line. A dropped case is not a statute.
Remote-USA and Remote-Canada are different jobs. Geography is not a preference on these postings.
Platform scope. 'Blockchain platform' is several teams. The posting title is the team. Read it.

Ask them

Which ledger does this team own, and what is the on-call rotation?
Was this team part of the 2026 reduction, and is the req a backfill?
What is the cash band and the refresh, in writing, before you spend a loop on it?
For Canada: which employing entity, and are you expected to overlap U.S. hours?

Sources

If a figure is not in those sources, it is not in this brief on purpose.

How the first months would actually go

Illustrative preparation

Not the employer’s onboarding plan.

Days 1–30: the environment, the scope document, and one shadowed finding.
Days 31–60: a finding you drove to a fix. Severity calibrated to their scale, not yours.
Days 61–90: a note on where AI helped and where it wasted a week. They asked for the tool. Show judgment about it.

A week you can rehearse

Reproduce one public-class bug against a local demo. Write the retest.
Separate application bugs from chain bugs in your own portfolio. This seat is the first.
Prepare a question about rules of engagement. Offensive work without a written scope is how people get fired.

What to take into the room

Illustrative preparation

Walk a bug you found, end to end, including the fix you would accept.
How do you keep an automated finder from drowning a team?
Why Canada, for you, beyond the posting matching your passport?

Proof you can build before you apply

The security-review lab. One mitigation, retested. Label it illustrative. Do not probe Coinbase.

Open Security review of a local demo. Review a local demo, write the threat model, and document one mitigation.

Walk away if

The scope is 'everything' and the rules of engagement are verbal.
The recruiter says Remote - Canada is flexible for a strong U.S. candidate. Believe the posting.
AI tooling is mandatory theatre and manual review is discouraged.

What the employer actually wrote

Employer stated. Coinbase frames this as offensive security on the application-security team, including AI-assisted vulnerability discovery. It is not a protocol-research seat.

Build, deploy, and maintain custom security scanners that leverage frontier models to detect vulnerabilities at scale across Coinbase's product surface.
Lead red teaming efforts against internal AI systems, including jailbreak testing, prompt injection analysis, and tool abuse simulation.
Develop AI-driven automation for vulnerability triage, validation, and remediation workflows to accelerate the bug bounty and vulnerability response pipelines.
Partner with engineering teams to prioritize, remediate, and verify fixes for critical vulnerabilities discovered through AI-augmented and manual testing.
Mentor junior security engineers on integrating AI into offensive security workflows to scale team capabilities.

Source: the employer’s public Greenhouse record, job 8165389. Open the original. First seen by this desk 2026-10-06. Nothing above the fold is a substitute for that page.

A reading of the work

Blockchain Lab analysis. These lines are a reading of the advertisement. They are not extra hiring requirements.

Threat-model the privilege boundary before the bug list.
Tie each finding to a concrete control, not a slogan.
Show how you would re-test the fix.

Still not disclosed

Compensation, unless a figure appears in the header. None of these eighteen postings stated one.
Closing date, and the day the role was first published. The board timestamp is an update.
Visa sponsorship, on-call, and the employing subsidiary.

Not a recommendation to apply. Not an employer assessment. Figures from public reporting move, and a database is not a filing. How this desk labels evidence. Report a listing.

Coinbase · Remote - Canada · pay not disclosed

Apply