Security Operations Analyst

San Francisco, CA - Hybridfull timeHybrid

Apply on Employer Site

mid

H1B: yes

Gusto Security Operations Analyst at Gusto owns and delivers security operations projects and leads incident response across multi-cloud environments. The role involves building Python-based automation and improving detection and monitoring for security threats.

Responsibilities

5+ years of experience in security operations, incident response, SOC analysis, or a closely related field.
Demonstrated experience leading or serving as the primary owner of a project or initiative, including coordinating with other teams.
Hands-on experience responding to security incidents, including investigation, root cause analysis, and post-incident follow-through.
Working knowledge of security monitoring, incident response, and vulnerability management.
Familiarity with core cloud security services across major providers (AWS, GCP, or similar) and cloud security fundamentals.
Comfortable working in Linux environments.
Proficiency in Python for scripting and automation.
Hands-on experience with enterprise security tools (SIEM, EDR, SOAR, DLP). Deploying or architecting these tools from scratch is not expected at this level.
Strong analytical and problem-solving skills, with the ability to communicate findings clearly and escalate appropriately.
Comfortable using AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools), with a working understanding of AI-specific security risks (prompt injection, data exfiltration via connected tools/MCPs, over-permissioned agents) and how to mitigate them.

Qualification

Exposure to CI/CD security concepts (eSecurity certifications (e

Required

Familiarity with identity and access concepts (service accounts, API keys/tokens, OAuth) and curiosity about how AI agents and MCP-connected tools introduce new identity and access risk. Deep specialist experience is not expected at this level.
Willingness and ability to participate in a lightweight, business-hours-oriented on-call rotation.
Experience with log analysis or digital forensics in cloud or on-premise environments.
Experience with incident response involving multiple stakeholders.
Experience writing or improving detections and playbooks.
Familiarity with common vulnerability classes and remediation approaches.
Exposure to CI/CD security concepts (e.g., dependency scanning tools like GitHub Dependabot).
Familiarity with common security frameworks (e.g., NIST, SOC 2).
Experience with identity and access management, non-human identity, secrets management, or MCP/agent architecture.
Experience mentoring or onboarding teammates.
Security certifications (e.g., Security+, GSEC) are a plus. Advanced certifications (CISSP, CISM, etc.) are not expected at this level.