Security Operations Analyst

Gusto, Inc.•Denver, CO

2d•$147,000 - $199,000

About The Position

Gusto is seeking a Security Operations Analyst with 5+ years of experience to own and deliver security operations projects, participate in incident response, and improve the team’s ability to detect and respond to threats. The analyst will work across a multi-cloud environment, build Python-based automation, and help govern non-human identities and AI/agent connections. The role owns medium-sized initiatives, collaborates with senior analysts, and helps mentor newer teammates. The Security Operations team monitors, investigates, and responds to security events during business hours across Eastern and Pacific time zones, with a lightweight rotation for rare after-hours escalation of critical incidents. This is a business-hours-oriented role, not a 24/7 pager position. The current on-call rotation is about one week per month and is expected to shift to roughly every 5–6 weeks as the team grows. Approximately one-third of the role focuses on non-human identity and agentic AI governance. Gusto has offices in Denver, San Francisco, and New York City. Employees based in those locations are expected to work from the office on designated days approximately 2–3 days per week, or more depending on the role. When approved to work elsewhere, employees need a secure, reliable, and consistent internet connection. The posting does not specify a single workplace type for this position.

Requirements

At least 5 years of experience in security operations, incident response, SOC analysis, or a closely related field.
Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordination with other teams.
Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
Working knowledge of security monitoring, incident response, and vulnerability management.
Familiarity with core cloud security services from AWS, GCP, or similar providers, and cloud security fundamentals.
Comfort working in Linux environments.
Proficiency in Python for scripting and automation.
Hands-on experience with enterprise security tools such as SIEM, EDR, SOAR, and DLP; deploying or architecting these tools from scratch is not expected.
Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
Comfort using AI-assisted tooling, with a working understanding of AI-specific security risks—including prompt injection, data exfiltration via connected tools or MCPs, and over-permissioned agents—and how to mitigate them.
Familiarity with identity and access concepts such as service accounts, API keys or tokens, and OAuth, plus curiosity about identity and access risks introduced by AI agents and MCP-connected tools.
Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

Nice To Haves

Experience with log analysis or digital forensics in cloud or on-premise environments.
Experience with incident response involving multiple stakeholders.
Experience writing or improving detections and playbooks.
Familiarity with common vulnerability classes and remediation approaches.
Exposure to CI/CD security concepts, such as dependency scanning tools like GitHub Dependabot.
Familiarity with security frameworks such as NIST or SOC 2.
Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
Experience mentoring or onboarding teammates.
Security certifications such as Security+ or GSEC; advanced certifications such as CISSP or CISM are not expected at this level.

Responsibilities

Own medium-sized security operations projects end to end, from problem definition and design through rollout and measurement; coordinate stakeholders, communicate progress and risks, and drive completion.
Triage, investigate, and respond to security incidents across cloud and corporate environments; document root causes and remediation, contribute to post-mortems, and complete follow-up actions.
Monitor and triage alerts from security tools, tune detections, reduce noise, and recommend configuration and process improvements.
Write Python to extend automation frameworks and SOAR playbooks; ensure shipped work is tested, documented, and high quality.
Conduct threat hunts across multi-cloud and corporate environments using threat intelligence and team playbooks, and turn findings into detections or playbooks.
Help govern machine identities, service accounts, secrets, and MCP/agent connections; expand DLP policy coverage, address unowned cloud secrets and service accounts, and develop proactive, risk-based MCP governance.
Use AI-assisted tools for security operations and apply judgment to risks such as prompt injection, data exfiltration, and over-permissioned agents; help establish team practices for reviewing and validating AI-assisted work.
Partner with analytics, IT, and product teams to support secure practices and communicate findings to technical and non-technical stakeholders.
Mentor newer teammates, share knowledge through documentation, and contribute to hiring by interviewing candidates.
Participate in the lightweight on-call rotation for rare after-hours escalations and follow through on post-mortem action items.