The opportunity
At Gusto, we're on a mission to grow the small business economy. We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers.
What you'll do
Own ITGC design and operation across enterprise applications: including logical access, change management, SDLC, computer operations, and segregation of duties (SoD).
Lead the 1st-line control environment for in-scope enterprise applications,: partnering with application owners and engineering leads to embed controls into operational workflows rather than bolting them on.
Drive SoD strategy across ERP, HRIS, and CRM: including role design reviews, conflict remediation, mitigating control design, and ongoing monitoring tooling (e.g., Pathlock, SailPoint, Saviynt, native role analyzers).
Manage the audit lifecycle as the primary 1st-line liaison with Internal: Audit, External Audit, and the SOX PMO — walkthroughs, evidence collection, deficiency remediation, and management responses.
Build AI-native continuous controls monitoring: including LLM-based evidence review, agentic control testing, and automated anomaly surveillance — to eliminate manual evidence collection, shift controls left, and surface exceptions in near real time. Treat AI agents as control operators with the same evidence and validation expectations as human operators.
Own the controls posture for Gusto's internal AI and automation portfolio.: Partner with AI-builder teams across the company (Finance & BizOps, GRC, Engineering) to review internal AI use cases, classify by risk category, and ensure controls, evidence trails, and validation travel with the build — not bolted on after launch. Be the senior 1st-line owner for "do our internal AI builds meet our control standards?
What they're looking for
- Lead access governance including provisioning/deprovisioning workflows,: periodic user access reviews (UARs), privileged access management, and integration with the IGA platform.
- Govern application change management for in-scope systems: approvals, segregation between developers and production, emergency change handling, and release evidence.
- Mature the controls program by leading rationalization initiatives, control: consolidation, and the adoption of automated/preventive controls over manual/detective ones.
- Partner cross-functionally with Security/GRC, Legal, Finance/Accounting,: People Operations, and Revenue Operations to ensure controls support — rather than impede — the business.
