Security Engineer – Cloud and Network Security

Gusto

Security Engineer leading edge and network defense for Gusto, which provides payroll, benefits, and HR services to small businesses. Owning Cloudflare, AWS perimeter security, and AI-assisted security automation.

Posted 8/17/2026full-timeSan Francisco • California • 🇺🇸 United StatesSeniorLead💰 $230,000 - $270,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in edge and network security, with a strong focus on Cloudflare technologies, AWS networking, and policy-as-code practices. Proven ability to lead incident response and collaborate on architectural decisions to enhance security posture.

Highest-signal resume keywords

Cloudflare WAF ExpertiseAWS Networking ExpertisePolicy-As-Code ProficiencyIncident Response ExperienceNetwork Architecture Expertise

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Edge SecurityNetwork SecurityTerraformCloudflareDDoS ProtectionBot ManagementVPC DesignIAMDetection EngineeringZero Trust

Soft Skills

Excellent Communication

Tools & Technologies

Cloudflare WAFMCP-Driven ToolingPantherClaude CodeCrossplane

Certifications & Qualifications

AWS Certified Advanced Networking SpecialtyAWS Certified Security SpecialtyCloudflare Certified Security AssociateCloudflare Certified Security ProfessionalCKS

Industry Keywords

Network FirewallCloud SecurityContainer SecurityVulnerability ManagementEgress Filtering

Tech Stack

Tools & technologies

AWSCloudTerraform

About the role

Key responsibilities & impact

Lead Gusto's edge and network security strategy
Design and operate the Cloudflare WAF, DDoS protection, Bot Management, WARP, Gateway, and Access security stack
Own the network security perimeter across AWS and the edge, including VPC design, Network Firewall, Shield, CloudFront, NACLs, and egress filtering
Codify security controls in Terraform and Crossplane
Develop policy-as-code patterns with pull-request review, testing, and rollback paths
Build detections and alerting from Cloudflare logs, VPC Flow Logs, and CloudTrail into Panther
Lead incident response for perimeter and network events
Contribute to cloud posture, container security, IAM, vulnerability management, and on-call
Use Claude Code, MCP-driven tooling, and agentic workflows for investigation, automation, and detection engineering
Prototype and ship agents, custom MCP servers, and LLM-assisted automations
Partner with infrastructure and product teams on high-impact architectural decisions

Requirements

What you’ll need

10+ years of hands-on security engineering experience, including significant edge, network, or perimeter security ownership at scale
Production-grade expertise with Cloudflare WAF, DDoS, Bot Management, WARP, Gateway, and Access
Experience with rule tuning, incident response, and Zero Trust rollouts
Network architecture expertise in TLS/mTLS, segmentation, egress controls, and DDoS resilience
AWS networking expertise including VPC, Network Firewall, Shield, CloudFront, and NACLs
Fluency with policy-as-code, Terraform, and CI/CD-first security control delivery
Crossplane or similar experience is a plus
Foundation in cloud security, IAM, container security, and detection engineering
Hands-on incident response experience using edge and network telemetry in a modern SIEM
Daily use of Claude Code or equivalent agentic tooling
Experience building custom MCP servers, agents, and LLM automations
Excellent written and verbal communication
Relevant certifications are a plus, including AWS Certified Advanced Networking Specialty, AWS Certified Security Specialty, Cloudflare Certified Security Associate/Professional, CKS, or equivalent

Benefits

Comp & perks

Competitive base pay
Health insurance
401(k)
Equity (RSUs)
Secure, reliable, and consistent internet connection required when working outside a Gusto office
Equal opportunity employer
Reasonable accommodations for qualified individuals with disabilities and disabled veterans