Security Operations Analyst

At Gusto, we're on a mission to grow the small business economy.

The Security Operations team at Gusto plays a critical role in fortifying Gusto and our customers against sophisticated threats: phishing attacks, insider risks, data loss, and emerging attack techniques.

Responsibilities

• Own security operations projects end to end. Take medium-sized initiatives (typically 1-2 months, often spanning multiple teams) from problem definition through design, rollout, and measurement.
• Lead and participate in incident response. Triage, investigate, and respond to security incidents across our cloud and corporate environments.
• Improve detection and monitoring. Monitor and triage alerts from tools like AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, and our CSPM platform.
• Build security operations automation. Write Python to extend our automation frameworks and SOAR playbooks, reducing manual work and improving response times.
• Threat hunting. Hunt for threats across our multi-cloud and corporate environments using threat intelligence and the team's playbooks, and turn findings into new detections or playbooks.
• Non-human identity and agentic AI governance (roughly one-third of your time). Help govern machine identities, service accounts, and MCP/agent connections that now outnumber human accounts.
• AI-assisted security operations. Use AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools) to work faster on querying, investigating, and drafting, and apply sound judgment about risks specific to AI tooling.
• Collaborate and mentor. Partner with analyzing, IT, and product teams to support secure practices and communicate findings clearly to technical and non-technical stakeholders.
• Participate in the on-call rotation. This is a business-hours role with a lightweight on-call rotation for rare after-hours escalations.

Requirements

• 5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.
• Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.
• Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
• Working knowledge of security monitoring, incident response, and vulnerability management.
• Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.
• Comfortable working in Linux environments.
• Proficiency in Python for scripting and automation.
• Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP).
• Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
• Comfortable using AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools), with a working understanding of AI-specific security risks.
• Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and curiosity about how AI agents and MCP-connected tools introduce new identity and access risk.
• Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

Preferred Qualifications

• Experience with log analysis or digital forensics in cloud or on-premise environments.
• Experience with incident response involving multiple stakeholders.
• Experience writing or improving detections and playbooks.
• Familiarity with common vulnerability classes and remediation approaches.
• Exposure to CI/CD security concepts (e.g., dependency scanning tools like GitHub Dependabot).
• Familiarity with common security frameworks (e.g., NIST, SOC 2).
• Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
• Experience mentoring or onboarding teammates.
• Security certifications (e.g., Security+, GSEC) are a plus.

Compensation

Our cash compensation amount for this role is targeted at $147,000-164,000 in Denver, $178,000-199,000 in New York and San Francisco Bay Area. Stock equity is additional.