Security Technical Program Manager

About Gusto

At Gusto, were on a mission to grow the small business economy We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers

With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide and are building a workplace that reflects the people we serve.

All full-time employees receive competitive base pay, benefits, and equity (RSUs) — because everyone who helps build Gusto should share in its success. Offer amounts are determined by role, level, and location. Learn more about our Total Rewards philosophy .

AI is a fundamental part of how work gets done at Gusto. We expect all team members to actively engage with AI tools relevant to their role and grow their fluency as the technology evolves. AI experience requirements vary by role and will be assessed during the interview process.

About the Role

Gusto is becoming an AI-native company, and that only works if our security posture keeps pace As the Vulnerability Management Technical Lead, youll own the definition and delivery of Gustos vulnerability management and security operations programs across Security, AIT, R&D, Infrastructure, GRC, and Risk

Youll drive the centralized vulnerability scorecard, expand detection and monitoring coverage, harden the SDLC, and stand up the security metrics leadership runs the business on

Youll drive the timelines, manage the dependencies, head off the risk, and use AI plugins to do the work itself, so security becomes something that helps Gusto move faster instead of slowing it down.

About the Team

The TPM organization is part of our AIT, Risk, and Security team We deliver the cross-functional work that lets Gusto securely accelerate its AI and platform modernization

The vulnerability management and security operations programs sit right at the intersection of security engineering, infrastructure, and GRC, and theyre foundational to how Gusto scales its AI ambitions safely

This is one of the most strategic programs on the team, and youll lead it across a complex, fast-moving group of stakeholders.

Here’s what you’ll do day-to-day

Set the strategy and the roadmap

Work with leaders across Security, AIT, R&D, Infrastructure, GRC, and Risk to shape where vulnerability management and security operations go as Gusto becomes an AI-native company

Define what good vulnerability management and security operations look like for an AI-first business, and set the multi-quarter vision that gets us there Run intake and prioritization wit