# Security Operations Analyst at Gusto > Hybrid · United States · Unspecified · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Agusto%3A8348189 (read 2026-11-06). ## Facts (observed) - Company: [Gusto](https://alderhq.app/companies/gusto) - Location text: Denver, CO - Hybrid; New York, NY - Hybrid; San Francisco, CA - Hybrid; San Francisco, CA - Hybrid - Where it can be done from (inferred): Hybrid · United States (evidence: "Location: Denver, CO - Hybrid; New York, NY - Hybrid; San Francisco, CA - Hybrid; San Fran") - Posted: 2026-11-06 (0 days ago) - First seen by alder: 2026-11-06 · last verified: 2026-11-06 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://job-boards.greenhouse.io/gusto/jobs/8348189 - Skills listed (inferred): Python, AWS, GCP ## Pay and sponsorship - Posted pay: not posted - Market band for similar posted roles (Denver, n 3): p25 $97k, median $119k, p75 $128k - H-1B filings at this company for similar roles, FY26: 22, median offered wage $233k ([US DOL OFLC LCA disclosure data](https://www.dol.gov/agencies/eta/foreign-labor/performance)) ## Description (the employer's text) ### About Gusto At Gusto, we're on a mission to grow the small business economy. We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers. With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide and are building a workplace that reflects the people we serve. All full-time employees receive competitive base pay, benefits, and equity (RSUs) — because everyone who helps build Gusto should share in its success. Offer amounts are determined by role, level, and location. Learn more about our Total Rewards philosophy. AI is a fundamental part of how work gets done at Gusto. We expect all team members to actively engage with AI tools relevant to their role and grow their fluency as the technology evolves. AI experience requirements vary by role and will be assessed during the interview process. ### About the team The Security Operations team at Gusto plays a critical role in fortifying Gusto and our customers against sophisticated threats: phishing attacks, insider risks, data loss, and emerging attack techniques. Our distributed team across Eastern and Pacific time zones monitors, investigates, and responds to security events during business hours, with a lightweight rotation for rare after-hours escalation of critical incidents. We're looking for a Security Operations analyst with 5+ years of experience to own and deliver security operations projects, take an active role in incident response, and raise the bar for how our team detects and responds to threats. You'll work across our multi-cloud environment (AWS, GCP, and others), build Python-based automation, and help govern the fastest-growing part of our attack surface: non-human identities and AI/agent connections. You'll be the directly responsible individual for medium-sized initiatives, work closely with senior analysts, and help mentor newer teammates. ### Here's what you'll do Own security operations projects end to end. Take medium-sized initiatives (typically 1-2 months, often spanning multiple teams) from problem definition through design, rollout, and measurement. Break down ambiguous goals into deliverables, set expectations with stakeholders, communicate progress and risks, and drive work to completion. Lead and participate in incident response. Triage, investigate, and respond to security incidents across our cloud and corporate environments. Serve as a core responder, document root cause and remediation, write or contribute to post-mortems, and own the completion of post-mortem action items so lessons turn into lasting improvements. Improve detection and monitoring. Monitor and triage alerts from tools like AWS GuardDuty/Security Hub/WAF, GCP Security Command Center, and our CSPM platform. Tune and improve detections, reduce noise, and recommend configuration and process improvements based on what you learn from investigations. Build security operations automation. Write Python to extend our automation frameworks and SOAR playbooks, reducing manual work and improving response times. Own the quality, testing, and documentation of what you ship. Threat hunting. Hunt for threats across our multi-cloud and corporate environments using threat intelligence and the team's playbooks, and turn findings into new detections or playbooks. Non-human identity and agentic AI governance (roughly one-third of your time). Help govern machine identities, service accounts, and MCP/agent connections that now outnumber human accounts. Drive improvements such as expanding DLP/Nightfall policy coverage for AI and MCP-connected tools, attributing and cleaning up unowned cloud secrets and service accounts, and moving our MCP review process from reactive intake to proactive, risk-based governance. AI-assisted security operations. Use AI-assisted tooling (e.g., Claude Code, Claude Skills, MCP-connected tools) to work faster on querying, investigating, and drafting, and apply sound judgment about risks specific to AI tooling, such as prompt injection, data exfiltration through connected tools, and over-permissioned agents. Help set team norms for reviewing and validating AI-assisted work. --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Agusto%3A8348189 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.