Hybrid Security Operations Lead – Cloud & AI

Gusto, Inc.; Denver, New York, San Francisco (CO, NY, CA); Hybrid; USD 147,000 - 164,000; Full time

Benefits offered by this job

Equity (RSUs)

Competitive base pay and benefits

Job summary

Gusto, with teams in Denver, SF, and New York, seeks a Security Operations analyst to own end‑to‑end security projects, lead incident response, and advance detection across multi‑cloud environments. You will develop Python automation, govern non‑human identities, and mentor teammates in a hybrid, business‑hours role.

The role emphasizes collaboration with IT, product, and analytic teams, participation in on‑call rotations, and applying AI‑assisted tooling while managing risk and governance for

Qualifications

• 5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.
• Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.
• Hands‑on experience responding to security incidents, including investigation, root cause analysis, and post‑incident follow‑through.
• Working knowledge of security monitoring, incident response, and vulnerability management.
• Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.
• Proficiency in Python for scripting and automation.
• Hands‑on experience with enterprise security tools (SIEM, EDR, SOAR, DLP).
• Strong analytical and problem‑solving skills, with the ability to communicate findings clearly and elevate appropriately.
• Familiarity with identity concepts and AI tooling security risks.

Responsibilities

• Own security operations projects end to end, typically 1–2 months, from problem definition to rollout and measurement.
• Lead and participate in incident response across cloud and corporate environments.
• Improve detection and monitoring, tuning detections and reducing noise.
• Build security operations automation with Python and SOAR playbooks.
• Threat hunting across multi‑cloud and corporate environments to develop new detections and playbooks.
• Govern non‑human identities and MCP/agent connections, expanding policy coverage for AI tools.

Skills

Security operations

Incident response

SOC analysis

Cloud security

Python scripting

Linux

AI tooling

Threat hunting

On-call readiness

Stakeholder communication

Tools

SIEM

EDR

SOAR

DLP

AWS

GCP

Job description

Gusto, with teams in Denver, SF, and New York, seeks a Security Operations analyst to own end‑to‑end security projects, lead incident response, and advance detection across multi‑cloud environments. You will develop Python automation, govern non‑human identities, and mentor teammates in a hybrid, business‑hours role.

The role emphasizes collaboration with IT, product, and analytic teams, participation in on‑call rotations, and applying AI‑assisted tooling while managing risk and governance for