Note: The job is a remote job and is open to candidates in USA. Gravity Payments is seeking a Security Analyst to strengthen security across its cloud, endpoint, identity, SaaS, and corporate environments. The role focuses on alert triage, incident investigation and response, threat hunting, security automation, compliance support, and improving detection and response capabilities.
Responsibilities
- Monitor, triage, investigate, and disposition security alerts across SIEM, endpoint, cloud, identity, email, SaaS, network, data loss prevention, and file integrity sources. Take part in the shared 24/7 on-call rotation, perform initial containment, and escalate confirmed or complex incidents promptly
- Engineer automation and integrations across the security stack, developing the code that connects and orchestrates our security tools, and advances our SOAR playbooks to reduce intervention and speed response. Apply agentic AI as a force multiplier, with tested results, human control, and full audit for any action it takes
- Investigate security incidents, malicious email, suspected fraud, insider threats, and data loss events. Conduct proactive threat hunts, preserve relevant evidence, and contribute clear incident reports and follow-up actions
- Build and maintain SaaS, endpoint, and application security posture; operate file integrity monitoring; run phishing simulations; support penetration tests; and track identified gaps through remediation, mitigation, or technical acceptance of risk
- Support PCI DSS and SOC 2 compliance program through evidence collection automation and audit engagement interviews
- Maintain and iterate weekly and quarterly reporting for organization leadership. Maintain investigation and response documentation, and daily guidance to team members through the company security help channels
- Continuously bring your unique experience and expertise to lead us through changes in detection and response paradigms
Skills
- At least 3 years of hands-on experience in security operations, incident response, vulnerability management, systems administration, or a closely related role. Experience must include independent alert investigation and escalation or containment responsibility
- A bachelor's degree in cybersecurity, computer science, information technology, or a related field, or an equivalent combination of practical experience, training, and certification
- Hands-on experience with SIEM and EDR/XDR platforms and with security telemetry from cloud, endpoint, identity, email, and SaaS systems. Our environment includes CrowdStrike NG-SIEM, AWS CloudTrail and CloudWatch, AWS Security Hub, Okta, Microsoft Entra, Google Workspace, Keeper, Duo, UniFi, Microsoft Defender, Jira, and MintMCP
- Ability to query, interpret, and correlate logs by using a SIEM query language such as LogScale/CQL, SPL, or a comparable language. Ability to use Python, PowerShell, and shell scripts for repeatable actions and analysis
- Advanced working knowledge of Windows, macOS, and Linux system internals; patch and configuration management; endpoint hardening; network and internet protocols; and identity and access concepts
- Extensive demonstrated experience with incident triage, containment, evidence collection, threat hunting, phishing analysis, and incident documentation. Strong understanding of MITRE ATT&CK and advanced attacker techniques is required
- Demonstrated experience with vulnerability management, including risk-based prioritization, remediation tracking, and use of CVSS, exploitability information, and service level targets
- Working knowledge of AWS security services and cloud investigation methods
- Working knowledge of PCI DSS, SOC 2, or similar security and compliance frameworks, with experience collecting evidence or supporting control testing
- Ability to take part in a shared 24/7 on-call rotation and be responsive to time-sensitive events
- Must have access to a wired internet connection and access to at least a 25 megabits per second (mbps) download and 20 mbps upload speed connection
- Experience working within or closely with Technology, Engineering, and DevOps teams at a small or midsize company, where cross-functional collaboration and shared ownership are expected
- Experience in the credit card payment services industry or another regulated financial services environment
- Strong judgment and attention to detail, with a calm, methodical approach under pressure and a sound sense of when to contain, when to escalate, and how to act on incomplete, uncertain, or noisy data
- Clear written and verbal communication that explains findings, risk, and required actions to technical and nontechnical audiences, and the ability to influence teams without direct authority
- Strong organization and follow-through, able to manage investigations, recurring operational work, and remediation tracking at the same time, with a continuous learning mindset toward current attacker methods and defenses
- A self-driven adopter of AI who treats it as a force multiplier, reaches for it by instinct to compare evidence, find gaps, speed up assessments, and verifies every output before use
- Experience with CloudTrail, CloudWatch, Security Hub, IAM, and cloud workload security is preferred
- Relevant certifications are strongly preferred but are not required. Examples include CompTIA Security+ or CySA+, Microsoft Certified: Security Operations Analyst Associate, GIAC GCIH or GCIA, and AWS Certified Security - Specialty
Benefits
- Profit Sharing
- Medical, dental, and vision coverage
- 401(k) retirement plan
- Voluntary life insurance
- Time off when you need it
- Open PTO available after one year
- Training, mentorship, and development opportunities
- Short-term and long-term disability coverage
- Wellness resources
Company Overview
Company H1B Sponsorship