# Security Operations Analyst

**Company**: Gusto
**Location**: Denver, CO
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $147,000-164,000 in Denver, $178,000-199,000 in New York and San Francisco Bay Area
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/gusto/jobs/8348189?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_f686c118-79d

## Description

At Gusto, we're on a mission to grow the small business economy.

The Security Operations team at Gusto plays a critical role in fortifying Gusto and our customers against sophisticated threats: phishing attacks, insider risks, data loss, and emerging attack techniques.

## Responsibilities

- Own security operations projects end to end. Take medium-sized initiatives (typically 1-2 months, often spanning multiple teams) from problem definition through design, rollout, and measurement.

- Lead and participate in incident response. Triage, investigate, and respond to security incidents across our cloud and corporate environments.

- Improve detection and monitoring. Monitor and triage alerts from tools like AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, and our CSPM platform.

- Build security operations automation. Write Python to extend our automation frameworks and SOAR playbooks, reducing manual work and improving response times.

- Threat hunting. Hunt for threats across our multi-cloud and corporate environments using threat intelligence and the team's playbooks, and turn findings into new detections or playbooks.

- Non-human identity and agentic AI governance (roughly one-third of your time). Help govern machine identities, service accounts, and MCP/agent connections that now outnumber human accounts.

- AI-assisted security operations. Use AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools) to work faster on querying, investigating, and drafting, and apply sound judgment about risks specific to AI tooling.

- Collaborate and mentor. Partner with analyzing, IT, and product teams to support secure practices and communicate findings clearly to technical and non-technical stakeholders.

- Participate in the on-call rotation. This is a business-hours role with a lightweight on-call rotation for rare after-hours escalations.

## Requirements

- 5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.

- Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.

- Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.

- Working knowledge of security monitoring, incident response, and vulnerability management.

- Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.

- Comfortable working in Linux environments.

- Proficiency in Python for scripting and automation.

- Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP).

- Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.

- Comfortable using AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools), with a working understanding of AI-specific security risks.

- Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and curiosity about how AI agents and MCP-connected tools introduce new identity and access risk.

- Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

## Preferred Qualifications

- Experience with log analysis or digital forensics in cloud or on-premise environments.

- Experience with incident response involving multiple stakeholders.

- Experience writing or improving detections and playbooks.

- Familiarity with common vulnerability classes and remediation approaches.

- Exposure to CI/CD security concepts (e.g., dependency scanning tools like GitHub Dependabot).

- Familiarity with common security frameworks (e.g., NIST, SOC 2).

- Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.

- Experience mentoring or onboarding teammates.

- Security certifications (e.g., Security+, GSEC) are a plus.

## Compensation

Our cash compensation amount for this role is targeted at $147,000-164,000 in Denver, $178,000-199,000 in New York and San Francisco Bay Area. Stock equity is additional.

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- Python
- AWS
- GCP
- Linux
- SIEM
- EDR
- SOAR
- DLP
- cloud security
- incident response
- security operations
- threat hunting
- AI-assisted tooling

### Nice to have
- log analysis
- digital forensics
- CI/CD security
- common security frameworks
- identity and access management
- secrets management
- mentoring

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/gusto/jobs/8348189?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)