[Hiring] Security Analyst @Gravity Payments

Role Description

A career with Gravity Payments is an opportunity to be on a collaborative team where creative leadership, passion for progress, and responsibility are paramount. Our team members focus and commit to providing for our clients and our community because we care deeply for others.

We are seeking a Security Analyst to operate and build security across our cloud, endpoint, identity, SaaS, and corporate environments. You will triage and investigate alerts, respond to incidents on a 24x7 rotation with the team, and hunt for threats that automated detections miss. You will be in a position to directly impact the quality of our existing security systems and be trusted to make decisions that will direct the path of our security program. This is a practical role for a careful investigator who can move from writing API integrations, to log analysis and containment, to remediation reporting. This is a hands-on, high-trust role for someone committed to protecting team members and customers through both operational excellence and building the next better system.

Success in this role looks like:

• Within 3 months: Co-owning first-line alert triage across our SIEM and connected tools, confidently serving as a first responder on the 24x7 on-call rotation, investigating and dispositioning alerts with prompt, clear escalation of real incidents.
• Within 6 months: Leading complex, sensitive investigations in our payments environment, such as analyzing fraud signals or account-takeover attempts, handling them with discretion, care, and sound evidence practice. Materially reducing the likelihood or impact of a tracked threat on our Risk Register, creating or advancing a SOAR playbook of your own design, and adding a new, fully correlated signal source to our SIEM.
• Within 1 year: Being a strong dual operator and builder who owns your corner of the security program. Leading significant threat investigations end to end, with automations that have measurably reduced response times and false-positive pages, and deciding where to invest in future automation efforts. Supporting PCI DSS and SOC 2 audits and tangibly maturing our detection, defense, and reporting so that real risks are identified and mitigated faster.

Qualifications

• Experience working within or closely with Technology, Engineering, and DevOps teams at a small or midsize company, where cross-functional collaboration and shared ownership are expected.
• Experience in the credit card payment services industry or another regulated financial services environment.
• Strong judgment and attention to detail, with a calm, methodical approach under pressure and a sound sense of when to contain, when to escalate, and how to act on incomplete, uncertain, or noisy data.
• Clear written and verbal communication that explains findings, risk, and required actions to technical and nontechnical audiences, and the ability to influence teams without direct authority.
• Strong organization and follow-through, able to manage investigations, recurring operational work, and remediation tracking at the same time, with a continuous learning mindset toward current attacker methods and defenses.
• A self-driven adopter of AI who treats it as a force multiplier, reaches for it by instinct to compare evidence, find gaps, speed up assessments, and verifies every output before use.

Requirements

• At least 3 years of hands-on experience in security operations, incident response, vulnerability management, systems administration, or a closely related role. Experience must include independent alert investigation and escalation or containment responsibility.
• A bachelor's degree in cybersecurity, computer science, information technology, or a related field, or an equivalent combination of practical experience, training, and certification.
• Hands-on experience with SIEM and EDR/XDR platforms and with security telemetry from cloud, endpoint, identity, email, and SaaS systems. Our environment includes CrowdStrike NG-SIEM, AWS CloudTrail and CloudWatch, AWS Security Hub, Okta, Microsoft Entra, Google Workspace, Keeper, Duo, UniFi, Microsoft Defender, Jira, and MintMCP.
• Ability to query, interpret, and correlate logs by using a SIEM query language such as LogScale/CQL, SPL, or a comparable language. Ability to use Python, PowerShell, and shell scripts for repeatable actions and analysis.
• Advanced working knowledge of Windows, macOS, and Linux system internals; patch and configuration management; endpoint hardening; network and internet protocols; and identity and access concepts.
• Extensive demonstrated experience with incident triage, containment, evidence collection, threat hunting, phishing analysis, and incident documentation. Strong understanding of MITRE ATT&CK and advanced attacker techniques is required.
• Demonstrated experience with vulnerability management, including risk-based prioritization, remediation tracking, and use of CVSS, exploitability information, and service level targets.
• Working knowledge of AWS security services and cloud investigation methods. Experience with CloudTrail, CloudWatch, Security Hub, IAM, and cloud workload security is preferred.
• Working knowledge of PCI DSS, SOC 2, or similar security and compliance frameworks, with experience collecting evidence or supporting control testing.
• Ability to take part in a shared 24/7 on-call rotation and be responsive to time-sensitive events.
• Relevant certifications are strongly preferred but are not required. Examples include CompTIA Security+ or CySA+, Microsoft Certified: Security Operations Analyst Associate, GIAC GCIH or GCIA, and AWS Certified Security - Specialty. Equivalent demonstrated experience is accepted.

Benefits

• Compensation: Competitive wage with Profit Sharing. Base pay without commissions and a unique opportunity to earn a share in company success.
• Comprehensive Benefits: Medical, dental, and vision coverage.
• Financial Security: 401(k) retirement plan and voluntary life insurance.
• Wellbeing: Time off when you need it, supporting both personal and professional sustainability. Open PTO available after one year.
• Career Growth: Training, mentorship, and development opportunities.
• Support & Stability: Short-term & long-term disability coverage and wellness resources.