Security Operations Lead: Cloud, AI & Automation

The Wrap; Denver, New York, San Francisco (CO, NY, CA); Hybrid; USD 147,000 - 164,000; Full time

Job summary

Gusto is seeking a Security Operations Analyst to own security operations projects end-to-end, lead incident response, and improve detection across AWS, GCP, and on-prem environments. You will build Python-based automations, govern non-human identities, and collaborate with cross-functional teams in a hybrid Denver-based role.

You’ll work with AI-assisted tooling, contribute to post-mortems, mentor teammates, and participate in a lightweight on-call rotation to ensure timely threat response.

Qualifications

• 5+ years of experience in security operations, incident response, SOC analysis, or similar field.
• Hands-on experience with incident response, root-cause analysis, and post-incident follow-through.
• Familiarity with cloud security services (AWS, GCP) and core security tools.

Responsibilities

• Own security operations projects end to end from problem definition through design, rollout, and measurement.
• Lead and participate in incident response across cloud and corporate environments.
• Improve detection and monitoring using tools like GuardDuty, Security Hub, CSPM; tune detections and reduce noise.
• Build automation with Python to extend SOAR playbooks and improve response times.
• Perform threat hunting across multi-cloud and on-prem environments, updating detections and playbooks.
• Govern non-human identities and AI-related connections; expand policy coverage for AI tools and MCP-connected tools.
• Collaborate with IT, product teams and mentors, contribute to hiring, and participate in the on-call rotation.

Skills

Python scripting

Cloud security

Incident response

Security monitoring

Security tooling

Linux

AI tooling

Non-human identity

Tools

AWS

GCP

Job description

Gusto is seeking a Security Operations Analyst to own security operations projects end-to-end, lead incident response, and improve detection across AWS, GCP, and on-prem environments. You will build Python-based automations, govern non-human identities, and collaborate with cross-functional teams in a hybrid Denver-based role.

You’ll work with AI-assisted tooling, contribute to post-mortems, mentor teammates, and participate in a lightweight on-call rotation to ensure timely threat response.