Security analyst

Gravity Payments; Boise (ID); On-site; USD 90,000 - 168,000; Full time

Benefits offered by this job

Profit sharing

Medical coverage

Dental coverage

Vision coverage

401(k) retirement plan

Open PTO after year

Training & mentorship

Disability coverage

Wellness resources

Job summary

Gravity Payments in Boise, Idaho is seeking a Security Analyst to build and operate security across cloud, endpoints, identity, SaaS, and corporate environments. You will triage alerts, respond to incidents on a 24x7 rotation, and hunt for threats that automated detections miss.

This hands-on role emphasizes operational excellence, threat investigations, and building next-gen security tooling, with opportunities to influence SIEM, SOAR, and incident reporting across the organization.

Qualifications

• Bachelor's degree in cybersecurity, computer science, information technology, or a related field, or an equivalent combination of practical experience, training, and certification.
• At least 3 years of hands-on experience in security operations, incident response, vulnerability management, systems administration, or related role.
• Hands-on experience with SIEM and EDR/XDR platforms and with security telemetry from cloud, endpoint, identity, email, and SaaS systems (e.g., CrowdStrike NG-SIEM, AWS CloudTrail, CloudWatch, Security Hub, Okta, Microsoft Entra, Google Workspace).
• Ability to query, interpret, and correlate logs using SIEM languages; proficient in Python, PowerShell, and shell scripts.
• Advanced knowledge of Windows, macOS, Linux internals; patching, endpoint hardening, networks, and IAM concepts.
• Experience with incident triage, containment, threat hunting, phishing analysis, and incident documentation; working knowledge of MITRE ATT&CK.
• Familiarity with vulnerability management, CVSS, remediation tracking, and SLTs; cloud security practices and PCI DSS/SOC 2 familiarity.
• On-call rotation experience and strong communications; relevant certifications (e.g., Security+, CySA+, GCIA) preferred.

Responsibilities

• Monitor, triage, investigate, and disposition security alerts across SIEM, endpoint, cloud, identity, email, SaaS, network, DLP, and FIM sources; participate in 24/7 on‑call rotation.
• Engineer automation and integrations across the security stack; develop code to orchestrate tools and enhance SOAR playbooks; apply agentic AI with auditability.
• Investigate incidents, malicious email, fraud signals, insider threats, and data loss; conduct proactive threat hunts and produce incident reports.
• Build and maintain SaaS, endpoint, and application security posture; support phishing simulations, penetration tests, and remediation tracking.
• Support PCI DSS and SOC 2 compliance through evidence collection automation and audit interviews.
• Maintain weekly and quarterly leadership reporting and publish investigation guidance to security channels.
• Lead investigations end-to-end; advance detections, reduce false positives, and influence future automation.

Job description

A career with Gravity Payments is an opportunity to be on a collaborative team where creative leadership, passion for progress, and responsibility are paramount. Our team members focus and commit to providing for our clients and our community because we care deeply for others.

We are seeking a Security Analyst to operate and build security across our cloud, endpoint, identity, SaaS, and corporate environments. You will triage and investigate alerts, respond to incidents on a 24x7 rotation with the team, and hunt for threats that automated detections miss. You will be in a position to directly impact the quality of our existing security systems and be trusted to make decisions that will direct the path of our security program. This is a practical role for a careful investigator who can move from writing API integrations, to log analysis and containment, to remediation reporting. This is a hands‑on, high‑trust role for someone committed to protecting team members and customers through both operational excellence and building the next better system.

Success in this role looks like:

• Within 3 months: You are co‑owning first‑line alert triage across our SIEM and connected tools, and you are confidently serving as a first responder on the 24x7 on‑call rotation, investigating and dispositioning alerts with prompt, clear escalation of real incidents.
• Within 6 months: You are trusted to lead complex, sensitive investigations in our payments environment, such as analyzing fraud signals or account‑takeover attempts, and you handle them with discretion, care, and sound evidence practice. You have materially reduced the likelihood or impact of a tracked threat on our Risk Register, created or advanced a SOAR playbook of your own design, and added a new, fully correlated signal source to our SIEM.
• Within 1 year: You are a strong dual operator and builder who owns your corner of the security program. You have led significant threat investigations end to end, your automations have measurably reduced response times and false–positive pages, and you decide where we invest in future automation efforts. You have supported PCI DSS and SOC 2 audits and have tangibly matured our detection, defense, and reporting so that real risks are identified and mitigated faster.

Core Responsibilities

• Monitor, triage, investigate, and disposition security alerts across SIEM, endpoint, cloud, identity, email, SaaS, network, data loss prevention, and file integrity sources. Take part in the shared 24/7 on‑call rotation, perform initial containment, and accelerate confirmed or complex incidents promptly.
• Engineer automation and integrations across the security stack, developing the code that connects and orchestrates our security tools, and advances our SOAR playbooks to reduce intervention and speed response. Apply agentic AI as a force multiplier, with tested results, human control, and full audit for any action it takes.
• Investigate security incidents, malicious email, suspected fraud, insider threats, and data loss events. Conduct proactive threat hunts, preserve relevant evidence, and contribute clear incident reports and follow‑up actions.
• Build and maintain SaaS, endpoint, and application security posture; operate file integrity monitoring; run phishing simulations; support penetration tests; and track identified gaps through remediation, mitigation, or technical acceptance of risk.
• Support PCI DSS and SOC 2 compliance program through evidence collection automation and audit engagement interviews.
• Maintain and iterate weekly and quarterly reporting for organization leadership. Maintain investigation and response documentation, and daily guidance to team members through the company security help channels.
• Continuously bring your unique experience and expertise to lead us through changes in detection and response paradigms.

Preferred Skills

• Experience working within or closely with Technology, Engineering, and DevOps teams at a small or midsize company, where cross‑functional collaboration and shared ownership are expected.
• Experience in the credit card payment services industry or another regulated financial services environment.
• Strong judgment and attention to detail, with a calm, methodical approach under pressure and a sound sense of when to contain, when to elevate, and how to act on incomplete, uncertain, or noisy data.
• Clear written and verbal communication that explains findings, risk, and required actions to technical and nontechnical audiences, and the ability to influence teams without direct authority.
• Strong organization and follow‑through, able to manage investigations, recurring operational work, and remediation tracking at the same time, with a continuous learning mindset toward current attacker methods and defenses.
• A self‑driven adopter of AI who treats it as a force multiplier, reaches for it by instinct to compare evidence, find gaps, speed up assessments, and verifies every output before use.

Technical Requirements

• At least 3 years of hands‑on experience in security operations, incident response, vulnerability management, systems administration, or a closely related role. Experience must include independent alert investigation and escalation or containment responsibility.
• A bachelor's degree in cybersecurity, computer science, information technology, or a related field, or an equivalent combination of practical experience, training, and certification.
• Hands‑on experience with SIEM and EDR/XDR platforms and with security telemetry from cloud, endpoint, identity, email, and SaaS systems. Our environment includes CrowdStrike NG‑SIEM, AWS CloudTrail and CloudWatch, AWS Security Hub, Okta, Microsoft Entra, Google Workspace, Keeper, Duo, UniFi, Microsoft Defender, Jira, and MintMCP.
• Ability to query, interpret, and correlate logs by using a SIEM query language such as LogScale/CQL, SPL, or a comparable language. Ability to use Python, PowerShell, and shell scripts for repeatable actions and analysis.
• Advanced working knowledge of Windows, macOS, and Linux system internals; patch and configuration management; endpoint hardening; network and internet protocols; and identity and access concepts.
• Extensive demonstrated experience with incident triage, containment, evidence collection, threat hunting, phishing analysis, and incident documentation. Strong understanding of MITRE ATT&CK and advanced attacker techniques is required.
• Demonstrated experience with vulnerability management, including risk‑based prioritization, remediation tracking, and use of CVSS, exploitability information, and service level targets.
• Working knowledge of AWS security services and cloud investigation methods. Experience with CloudTrail, CloudWatch, Security Hub, IAM, and cloud workload security is preferred.
• Working knowledge of PCI DSS, SOC 2, or similar security and compliance frameworks, with experience collecting evidence or supporting control testing.
• Ability to take part in a shared 24/7 on‑call rotation and be responsive to time‑sensitive events.
• Relevant certifications are strongly preferred but are not required. Examples include CompTIA Security+ or CySA+, Microsoft Certified: Security Operations Analyst Associate, GIAC GCIH or GCIA, and AWS Certified Security - Specialty. Equivalent demonstrated experience is accepted.

This job description is a snapshot of the role at this moment in time. As our organization evolves, so do our roles. Responsibilities may shift to meet changing business needs. We seek individuals who are adaptable, proactive, and open to growth as we continue to move forward together.

Additional Requirements

• Must have access to a wired internet connection and access to at least a 25 megabits per second (mbps) download and 20 mbps upload speed connection.

Benefits

• Compensation: Competitive wage with Profit Sharing. Base pay without commissions and a unique opportunity to earn a share in company success.
• Comprehensive Benefits: Medical, dental, and vision coverage.
• Financial Security: 401(k) retirement plan and voluntary life insurance.
• Wellbeing: Time off when you need it, supporting both personal and professional sustainability. Open PTO available after one year.
• Career Growth: Training, mentorship, and development opportunities.
• Support & Stability: Short‑term & long‑term disability coverage and wellness resources.

The salary for this position is $90,000 - $168,000. We may be open to negotiating outside of this range if the desired salary aligns with the needs of the candidate and the company.

Gravity Payments is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity/expression, age, disability status, protected veteran status, or any other characteristic protected by law.

Gravity Payments collects and processes personal data in accordance with applicable data protection laws. If you are a California Job Applicant see the privacy notice for further details.