Security Operations Analyst

Here's what you'll do

• Own security operations projects end to end.
• Take medium-sized initiatives (typically 1-2 months, often spanning multiple teams) from problem definition through design, rollout, and measurement.
• Break down ambiguous goals into deliverables, set expectations with stakeholders, communicate progress and risks, and drive work to completion.

Lead and participate in incident response. Triage, investigate, and respond to security incidents across our cloud and corporate environments. Serve as a core responder, document root cause and remediation, write or contribute to post-mortems, and own the completion of post-mortem action items so lessons turn into lasting improvements.

• Improve detection and monitoring.
• Monitor and triage alerts from tools like AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, and our CSPM platform.
• Tune and improve detections, reduce noise, and recommend configuration and process improvements based on what you learn from investigations.

• Build security operations automation.
• Write Python to extend our automation frameworks and SOAR playbooks, reducing manual work and improving response times.
• Own the quality, testing, and documentation of what you ship.

Threat hunting. Hunt for threats across our multi-cloud and corporate environments using threat intelligence and the team's playbooks, and turn findings into new detections or playbooks.

Non-human identity and agentic AI governance (roughly one-third of your time). Help govern machine identities, service accounts, and MCP/agent connections that now outnumber human accounts. Drive improvements such as expanding DLP/Nightfall policy coverage for AI and MCP-connected tools, attributing and cleaning up unowned cloud secrets and service accounts, and moving our MCP review process from reactive intake to proactive, risk-based governance.

AI-assisted security operations. Use AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools) to work faster on querying, investigating, and drafting, and apply sound judgment about risks specific to AI tooling, such as prompt injection, data exfiltration through connected tools, and over-permissioned agents. Help set team norms for reviewing and validating AI-assisted work.

• Collaborate and mentor.
• Partner with analyzing, IT, and product teams to support secure practices and communicate findings clearly to technical and non-technical stakeholders.
• Mentor newer teammates, share what you learn through documentation and knowledge sharing, and contribute to hiring by interviewing candidates.

Participate in the on-call rotation. This is a business-hours role with a lightweight on-call rotation for rare after-hours escalations, not a 24/7 pager rotation. You'll join the roster (currently about one week per month, shifting to roughly every 5-6 weeks as the team grows), respond to security incidents, and follow through on post-mortem action items afterward.

Minimum requirements

• 5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.
• Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.
• Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
• Working knowledge of security monitoring, incident response, and vulnerability management.
• Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.
• Comfortable working in Linux environments.
• Proficiency in Python for scripting and automation.
• Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP). Deploying or architecting these tools from scratch is not expected at this level.
• Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
• Comfortable using AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools), with a working understanding of AI-specific security risks (prompt injection, data exfiltration via connected tools/MCPs, over-permissioned agents) and how to mitigate them.
• Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and curiosity about how AI agents and MCP-connected tools introduce new identity and access risk. Deep specialist experience is not expected at this level.
• Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

Preferred qualifications

• Experience with log analysis or digital forensics in cloud or on-premise environments.
• Experience with incident response involving multiple stakeholders.
• Experience writing or improving detections and playbooks.
• Familiarity with common vulnerability classes and remediation approaches.
• Exposure to CI/CD security concepts (e.g., dependency scanning tools like GitHub Dependabot).
• Familiarity with common security frameworks (e.g., NIST, SOC 2).
• Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
• Experience mentoring or onboarding teammates.
• Security certifications (e.g., Security+, GSEC) are a plus. Advanced certifications (CISSP, CISM, etc.) are not expected at this level.

Compensation

Our cash compensation amount for this role is targeted at $147,000-164,000 in Denver, $178,000-199,000 in New York and San Francisco Bay Area. Stock equity is additional. Final offer amounts are determined by multiple factors including candidate experience and expertise and may vary from the amounts listed above.

At Gusto, we don't use titles the traditional way, as a signal of rank or hierarchy. Instead, our titles describe two things at once - your craft (what you do, e.g. Engineering, Design) and your scope of ownership (what you're accountable for) - which is why you'll see something like "Head of X" instead of a rank word like "Director" that tells you neither.

Because of this, the title on this posting may look different from what you'd expect based on the scope and seniority of the role, and from how similar roles are typically titled elsewhere. If you have questions about how this role compares to your current title or level, your recruiter can help translate.

Gusto has physical office spaces in Denver, San Francisco, and New York City. Employees who are based in those locations will be expected to work from the office on designated days approximately 2-3 days per week (or more depending on role). The same office expectations apply to all Symmetry roles, Gusto's subsidiary, whose physical office is in Scottsdale.

Note: The San Francisco office expectations encompass both the San Francisco and San Jose metro areas.

When approved to work from a location other than a Gusto office, a secure, reliable, and consistent internet connection is required. This includes non-office days for hybrid employees.

Reliable, consistent presence: We expect regular and predictable attendance, whether you're working in-office, hybrid, or fully remote, so that you stay closely connected to your team, customers, and stakeholders in real time and ensure colleagues and customers receive the timely support and responsiveness they deserve.

Our customers come from all walks of life and so do we. We hire great people from a wide variety of backgrounds, not just because it's the right thing to do, but because it makes our company stronger. If you share our values and our enthusiasm for small businesses, you will find a home at Gusto.

Gusto takes security and protection of your personal information very seriously. Please review our Fraudulent Activity Disclaimer.

Personal information collected and processed as part of your Gusto application will be subject to Gusto's Applicant Privacy Notice.