147K–199K USD / year
Security Operations Analyst
OperationsHybrid — Denver, CO, New York, NY, San Francisco, CA
Published on 2026-11-06
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Own security operations initiatives and respond to incidents across Gusto’s cloud and corporate environments. Improve threat detection and automation, and help govern non-human identities and AI agent connections.
About the company
Gusto is a digital platform that provides payroll, benefits, and human resource management solutions for small to medium-sized businesses. The company focuses on simplifying HR processes and ensuring compliance, while also offering tools for employee engagement and retirement planning.
The team
Security Operations team
Stack
AWSGCPAWS GuardDutyAWS Security HubAWS WAFGCP Security Command CenterCSPMPython
What you'll do
- Lead security operations projects from definition through rollout and measurement.
- Triage and investigate security incidents, document root causes, and drive post-incident improvements.
- Tune detections and monitoring to improve signal quality and reduce noise.
- Build, test, and document Python automation and SOAR playbooks.
- Conduct threat hunts and turn findings into detections or playbooks.
- Improve governance of service accounts, cloud secrets, and AI/MCP connections.
- Use AI-assisted tools responsibly and help establish team practices for validating their output.
- Collaborate with stakeholders, mentor teammates, and participate in a lightweight on-call rotation.
What we're looking for
- 5+ years in security operations, incident response, SOC analysis, or a related field.
- Experience owning projects and coordinating across teams.
- Hands-on incident response experience, including root cause analysis and follow-through.
- Knowledge of security monitoring, incident response, vulnerability management, and cloud security fundamentals.
- Comfort with Linux and proficiency in Python scripting and automation.
- Hands-on experience with enterprise security tools such as SIEM, EDR, SOAR, or DLP.
- Familiarity with AI security risks, identity and access concepts, and a willingness to join the on-call rotation.
Nice to have
- Cloud or on-premises log analysis or digital forensics experience.
- Experience improving detections and playbooks or handling multi-stakeholder incidents.
- Exposure to vulnerability remediation, CI/CD security, NIST, or SOC 2.
- Experience with IAM, non-human identities, secrets management, or MCP/agent architecture.
- Mentoring experience or a Security+ or GSEC certification.
Benefits
- Equity in the form of RSUs