Security Operations Analyst
Gusto · Denver, CO - Hybrid; New York, NY - Hybrid; San Francisco, CA - Hybrid
About this role
**Security Operations Analyst — Gusto** **About Gusto** At Gusto, we’re on a mission to grow the small business economy. We handle payroll, health insurance, 401(k)s, and HR—so owners can focus on their craft and customers. We support 500,000+ small businesses nationwide and build a workplace that reflects the people we serve. **Role overview** The Security Operations team fortifies Gusto and our customers against sophisticated threats like phishing, insider risk, data loss, and emerging attack techniques. You’ll monitor, investigate, and respond to security events across a multi-cloud environment (AWS, GCP, and others), with a lightweight on-call rotation for rare after-hours escalations. **What you’ll do** - **Own security operations projects end to end**: Lead medium-sized initiatives (typically 1–2 months) from problem definition through design, rollout, and measurement. - **Lead and participate in incident response**: Triage, investigate, respond, document root cause/remediation, write or contribute to post-mortems, and drive post-mortem action items to completion. - **Improve detection and monitoring**: Monitor and triage alerts (e.g., AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, CSPM). Tune detections, reduce noise, and recommend improvements. - **Build security operations automation**: Write **Python** to extend automation frameworks and SOAR playbooks, improving response times. Own quality, testing, and documentation. - **Threat hunting**: Hunt across multi-cloud and corporate environments using threat intel and team playbooks; turn findings into new detections or playbooks. - **Non-human identity & agentic AI governance (~1/3 of your time)**: Help govern machine identities, service accounts, and MCP/agent connections—expanding DLP/Nightfall coverage, cleaning up unowned cloud secrets/service accounts, and moving MCP review toward proactive, risk-based governance. - **AI-assisted security operations**: Use AI-assisted tooling (e.g., Claude Code/Skills, MCP-connected tools) while applying sound judgment for AI-specific risks (prompt injection, data exfiltration via connected tools, over-permissioned agents). - **Collaborate and mentor**: Partner with analyzing, IT, and product teams; communicate clearly to technical and non-technical stakeholders; mentor newer teammates and contribute to hiring. - **Participate in the on-call rotation**: Business-hours role with a lightweight rotation for rare after-hours escalations (not 24/7 paging). **Minimum requirements** - **5+ years** in security operations, incident response, SOC analysis, or closely related work - Experience **leading or owning** security operations projects/initiatives across teams - Hands-on incident response: investigation, root cause analysis, and follow-through - Working knowledge of security monitoring, incident response, and vulnerability management - Familiarity with core cloud security services (AWS/GCP or similar) - Comfortable working in **Linux** - **Python** proficiency for scripting/automation - Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP) - Strong analytical/problem-solving skills and clear communication - Comfortable using **AI-assisted tooling** and understanding AI security risks (prompt injection, data exfiltration via connected tools/MCPs, over-permissioned agents) - Familiarity with identity/access concepts (service accounts, API keys/tokens, OAuth) - Willingness/ability to participate in a lightweigh
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.