Security Operations Lead: Cloud & AI Defense

Gusto; San Francisco (CA); Hybrid; USD 147,000 - 199,000; Full time

Benefits offered by this job

Equity (RSUs)

Hybrid work model

Office in SF/Denver/New York

Job summary

Gusto is seeking a Security Operations Analyst with 5+ years of experience to own security projects and drive incident response in a multi-cloud environment (AWS, GCP). You’ll write Python to extend automation and partner with IT, product, and analytics teams to strengthen detections and governance of non-human identities.

You’ll contribute to threat hunting, AI-assisted security work, and on-call coverage while mentoring teammates and helping improve security posture across the org.

Qualifications

• 5+ years in security operations, incident response, or SOC analysis.
• Hands-on incident response experience across cloud and corporate environments.
• Proficient in Python for scripting and automation, with security context.

Responsibilities

• Own security operations projects end to end from problem to rollout and measurement.
• Lead and participate in incident response, document root causes, and drive post-mortems.
• Improve detection and monitoring across AWS, GCP, and on-prem environments.
• Build security automation and SOAR playbooks, with quality testing and docs.
• Hunt threats using threat intelligence and team playbooks.
• Govern non-human identities and AI-related security risk in MCP/agents.
• Use AI-assisted tooling to speed investigations while managing risks.
• Collaborate with IT, product and analytics teams and mentor teammates.
• Participate in lightweight on-call rotation during business hours.

Skills

Security operations

Incident response

Python scripting

Tools

AWS GuardDuty

AWS Security Hub

GCP Security Command Center

CSPM

SIEM

SOAR

DLP

Job description

Gusto is seeking a Security Operations Analyst with 5+ years of experience to own security projects and drive incident response in a multi-cloud environment (AWS, GCP). You’ll write Python to extend automation and partner with IT, product, and analytics teams to strengthen detections and governance of non-human identities.

You’ll contribute to threat hunting, AI-assisted security work, and on-call coverage while mentoring teammates and helping improve security posture across the org.