Security Operations Analyst

Gusto•San Francisco, NY

1d•Hybrid

About The Position

Gusto is hiring a Security Operations Analyst to help protect the company and its customers from threats including phishing, insider risks, data loss, and emerging attack techniques. The analyst will work across a multi-cloud environment, own and deliver security operations projects, participate actively in incident response, improve threat detection and response, and help govern non-human identities and AI/agent connections. The role includes ownership of medium-sized initiatives, collaboration with senior analysts, and mentoring newer teammates. The Security Operations team is distributed across Eastern and Pacific time zones and monitors, investigates, and responds to security events during business hours. The role includes a lightweight on-call rotation for rare after-hours escalations of critical incidents; it is not a 24/7 pager rotation. The role is focused in part on machine identities, service accounts, and MCP/agent connections, including improving DLP coverage, addressing unowned cloud secrets and service accounts, and making MCP reviews more proactive and risk-based. The analyst will also use AI-assisted tools while applying judgment to AI-related security risks and helping establish practices for reviewing AI-assisted work. Gusto has offices in Denver, San Francisco, and New York City. Employees based in those locations are expected to work from an office on designated days approximately 2–3 days per week, or more depending on the role. Work from a location other than a Gusto office requires a secure, reliable, and consistent internet connection. Compensation is targeted at $147,000–$164,000 in Denver and $178,000–$199,000 in New York and the San Francisco Bay Area; stock equity is additional. All full-time employees receive competitive base pay, benefits, and equity (RSUs).

Requirements

At least 5 years of experience in security operations, incident response, SOC analysis, or a closely related field.
Demonstrated experience leading or owning a project or initiative, including coordination with other teams.
Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
Working knowledge of security monitoring, incident response, and vulnerability management.
Familiarity with core cloud security services across AWS, GCP, or similar providers, and with cloud security fundamentals.
Comfort working in Linux environments.
Proficiency in Python for scripting and automation.
Hands-on experience with enterprise security tools such as SIEM, EDR, SOAR, and DLP; deploying or architecting these tools from scratch is not expected.
Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
Comfort using AI-assisted tooling such as Claude Code, Claude Skills, and MCP-connected tools, and working understanding of AI-specific security risks and mitigations, including prompt injection, data exfiltration through connected tools/MCPs, and over-permissioned agents.
Familiarity with identity and access concepts such as service accounts, API keys/tokens, and OAuth, and curiosity about identity and access risks introduced by AI agents and MCP-connected tools.
Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

Nice To Haves

Experience with log analysis or digital forensics in cloud or on-premise environments.
Experience with incident response involving multiple stakeholders.
Experience writing or improving detections and playbooks.
Familiarity with common vulnerability classes and remediation approaches.
Exposure to CI/CD security concepts, such as dependency scanning tools like GitHub Dependabot.
Familiarity with common security frameworks such as NIST or SOC 2.
Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
Experience mentoring or onboarding teammates.
Security certifications such as Security+ or GSEC; advanced certifications such as CISSP or CISM are not expected at this level.

Responsibilities

Own medium-sized security operations projects from problem definition through design, rollout, and measurement, coordinating stakeholders and communicating progress and risks.
Triage, investigate, and respond to security incidents across cloud and corporate environments; document root causes and remediation, contribute to post-mortems, and complete follow-up actions.
Monitor and triage alerts from cloud security services and CSPM tools; tune detections, reduce alert noise, and recommend configuration and process improvements.
Write Python to extend automation frameworks and SOAR playbooks, reducing manual work and improving response times; ensure shipped work is tested, documented, and high quality.
Hunt for threats across multi-cloud and corporate environments using threat intelligence and team playbooks, and turn findings into detections or playbooks.
Help govern machine identities, service accounts, and MCP/agent connections, including expanding DLP/Nightfall policy coverage, identifying and cleaning up unowned secrets and service accounts, and advancing proactive, risk-based MCP reviews.
Use AI-assisted tools to support querying, investigation, and drafting; apply sound judgment to AI-tooling risks and help set team norms for reviewing and validating AI-assisted work.
Collaborate with analytics, IT, and product teams to support secure practices and communicate findings to technical and non-technical stakeholders.
Mentor newer teammates, share knowledge through documentation and knowledge sharing, and contribute to hiring by interviewing candidates.
Participate in the lightweight, business-hours-oriented on-call rotation, respond to security incidents, and follow through on post-mortem action items.