Security Operations Analyst

LinuxCareers; Denver (CO); On-site; USD 147,000 - 199,000; Full time

Benefits offered by this job

Stock equity (RSUs)

Job summary

Gusto seeks a Security Operations Analyst to lead medium-sized security initiatives, respond to incidents across AWS, GCP, and corporate environments, and govern non-human identities and AI/agent security in a distributed team.

You will own security operations projects end-to-end, write Python automations, and mentor teammates while collaborating with product and IT teams. Strong cloud experience and Linux skills are essential.

Qualifications

• 5+ years in security operations or related field.
• Hands-on incident response experience including investigation and root-cause analysis.
• Working knowledge of cloud security services (AWS/GCP).
• Proficiency in Python for scripting and automation.
• Experience with enterprise security tools (SIEM/EDR/SOAR/DLP).
• Comfort with Linux environments and on-call rotation.

Responsibilities

• Own security operations projects end-to-end from design to rollout.
• Triage, investigate, and respond to security incidents across cloud and corporate environments.
• Monitor alerts from GuardDuty, Security Hub, WAF, and CSPM platforms to reduce noise.
• Write Python-based automation and SOAR playbooks to speed response times.
• Govern machine identities, API keys, and AI/agent security; expand DLP policies.
• Hunt threats using threat intel and formalize detections and playbooks.
• Collaborate with product/IT teams and participate in lightweight on-call rotation.

Skills

Security operations

Incident response

Python scripting

Cloud security

Linux

Threat hunting

Cross-team coordination

Communication

Education

Security+ or GSEC

Tools

SIEM

EDR

SOAR

DLP

Job description

Gusto is a fintech platform providing payroll, HR, and benefits services to over 500,000 small businesses. The Security Operations Analyst role leads medium-sized security initiatives, responds to incidents across cloud and corporate environments, and governs non-human identities and AI/agent security in a distributed team.

What You'll Do

• Own security operations projects end-to-end, breaking down ambiguous goals into deliverables and driving work from design through rollout and measurement
• Triage, investigate, and respond to security incidents across AWS, GCP, and corporate environments; document root causes and lead post-mortem action items
• Monitor and tune alerts from AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, and CSPM platforms to reduce noise and improve detections
• Write Python-based automation and SOAR playbooks to reduce manual incident response work and improve response times
• Govern machine identities, service accounts, and MCP/agent connections; expand DLP policies for AI-connected tools and manage unowned cloud secrets
• Hunt for threats using threat intelligence and team playbooks; translate findings into new detections and playbooks
• Use AI-assisted tools (Claude Code, Claude Skills, MCP) for investigation and querying while mitigating AI-specific security risks
• Mentor newer teammates, partner with product and IT teams, and participate in lightweight business-hours on-call rotation

What You Need

• 5+ years of experience in security operations, incident response, SOC analysis, or related field
• Demonstrated experience leading or owning projects, including cross-team coordination
• Hands-on incident response experience including investigation, root cause analysis, and post-incident follow-through
• Working knowledge of security monitoring, incident response, and vulnerability management
• Familiarity with core cloud security services across AWS, GCP, or similar cloud providers
• Comfort working in Linux environments
• Proficiency in Python for scripting and automation
• Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP)
• Strong analytical and problem-solving skills with ability to communicate findings and escalatre appropriately
• Comfortable using AI-assisted tooling with working understanding of AI-specific security risks (prompt injection, data exfiltration, over-permissioned agents)
• Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and AI agent identity risks
• Willingness and ability to participate in lightweight business-hours-oriented on-call rotation

Nice to Have

• Experience with log analysis or digital forensics in cloud or on-premise environments
• Experience with incident response involving multiple stakeholders
• Experience writing or improving detections and playbooks
• Familiarity with common vulnerability classes and remediation approaches
• Exposure to CI/CD security concepts (e.g., GitHub Dependabot dependency scanning)
• Familiarity with common security frameworks (NIST, SOC 2)
• Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture
• Experience mentoring or onboarding teammates
• Security certifications such as Security+ or GSEC (advanced certifications like CISSP or CISM not expected at this level)

Base salary $147,000–$164,000 in Denver; $178,000–$199,000 in New York and San Francisco Bay Area. Stock equity (RSUs) is additional. Final offer amounts determined by candidate experience, expertise, and location.