Security Operations Analyst
Gusto, Inc. · Denver, CO - Hybrid; New York, NY - Hybrid; San Francisco, CA - Hybrid
About the role
Owns security operations projects and serves as a core incident responder on Gusto's Security Operations team. The analyst triages and tunes alerts across AWS and GCP, writes Python automation and SOAR playbooks, hunts threats, and spends about a third of the time governing non-human identities and AI agent connections, including DLP coverage, unowned secrets and MCP reviews.
Gusto wants five or more years in security operations, incident response or SOC analysis, project ownership, cloud security fundamentals, Python, and experience with SIEM, EDR, SOAR and DLP tools. Hybrid in Denver, New York or San Francisco, with a light business-hours on-call rotation.