Security Operations Analyst

At Gusto, we're on a mission to grow the small business economy. We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers. With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide and are building a workplace that reflects the people we serve.

All full-time employees receive competitive base pay, benefits, and equity (RSUs) — because everyone who helps build Gusto should share in its success. Offer amounts are determined by role, level, and location. Learn more about our Total Rewards philosophy.

AI is a fundamental part of how work gets done at Gusto. We expect all team members to actively engage with AI tools relevant to their role and grow their fluency as the technology evolves. AI experience requirements vary by role and will be assessed during the interview process.

The Security Operations team at Gusto plays a critical role in fortifying Gusto and our customers against sophisticated threats: phishing attacks, insider risks, data loss, and emerging attack techniques. Our distributed team across Eastern and Pacific time zones monitors, investigates, and responds to security events during business hours, with a lightweight rotation for rare after-hours escalation of critical incidents.

We're looking for a Security Operations analyst with 5+ years of experience to own and deliver security operations projects, take an active role in incident response, and raise the bar for how our team detects and responds to threats. You'll work across our multi-cloud environment (AWS, GCP, and others), build Python-based automation, and help govern the fastest-growing part of our attack surface: non-human identities and AI/agent connections. You'll be the directly responsible individual for medium-sized initiatives, work closely with senior analysts, and help mentor newer teammates.

• →5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.
• →Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.
• →Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
• →Working knowledge of security monitoring, incident response, and vulnerability management.
• →Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.
• →Comfortable working in Linux environments.
• →Proficiency in Python for scripting and automation.
• →Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP). Deploying or architecting these tools from scratch is not expected at this level.
• →Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
• →Comfortable using AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools), with a working understanding of AI-specific security risks (prompt injection, data exfiltration via connected tools/MCPs, over-permissioned agents) and how to mitigate them.
• →Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and curiosity about how AI agents and MCP-connected tools introduce new identity and access risk. Deep specialist experience is not expected at this level.
• →Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.

• Experience with log analysis or digital forensics in cloud or on-premise environments.
• Experience with incident response involving multiple stakeholders.
• Experience writing or improving detections and playbooks.
• Familiarity with common vulnerability classes and remediation approaches.
• Exposure to CI/CD security concepts (e.g., dependency scanning tools like GitHub Dependabot).
• Familiarity with common security frameworks (e.g., NIST, SOC 2).
• Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
• Experience mentoring or onboarding teammates.
• Security certifications (e.g., Security+, GSEC) are a plus. Advanced certifications (CISSP, CISM, etc.) are not expected at this level.