Associate Cyber Engineer
About The Position
HealthEquity’s Security Operations team protects the financial and health information of millions of members. In this remote role, the Associate Cyber Engineer is the primary technical owner of overnight security operations, operating and improving AI agents and automations used for first-line triage, enrichment, and investigation. The engineer reviews cases requiring human judgment and makes decisions about escalation, containment, or closure. The role supports faster detection and response, reduces analyst fatigue, and promotes consistent operations across all three shifts. The position combines hands-on SOC operations with engineering and governance of agentic security workflows. The engineer builds, tests, and deploys automations and integrations across security platforms; tunes detections; maintains code and scripts; establishes guardrails and measures agent quality; and supports handoffs, analyst mentoring, and incident reviews. It involves handling sensitive personal, health, and financial data in accordance with company policy and applicable regulations. The role follows one of the listed 4/10 schedules: Sunday–Wednesday, 9 p.m.–7 a.m. Mountain Time; Wednesday–Saturday, 9 p.m.–7 a.m. Mountain Time; or Wednesday–Saturday, 9 a.m.–7 p.m. Mountain Time. The position is remote, with mandatory in-person onboarding at company headquarters once per quarter for the Trailhead session; required travel and accommodations are covered. The role may begin with virtual, self-paced onboarding.
Requirements
- At least 2 years of experience in security operations, detection engineering, incident response, or security engineering.
- Hands-on experience with SIEM and SOAR platforms such as Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar.
- Working knowledge of EDR/XDR, identity and access security, email security, and cloud security in Azure, AWS, or both.
- Proficiency in Python or a comparable language, with experience using APIs, JSON, and Git-based workflows.
- Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
- Solid understanding of MITRE ATT&CK and the incident response lifecycle.
- Clear written and verbal communication skills and sound judgment when working independently overnight.
- Ability to work the scheduled shift reliably and be reachable for escalations as required.
Nice To Haves
- Experience building or governing agentic workflows, including MCP, orchestration frameworks, or human-in-the-loop approval patterns.
- Experience with detection-as-code, infrastructure-as-code, or CI/CD for security content.
- Familiarity with regulated environments such as HIPAA, SOC 2, PCI DSS, or similar.
- Certifications such as GCIH, GCIA, GCFA, GCDA, Security+, CISSP, AZ-500, SC-200, or equivalent.
- Experience in financial services, healthcare, or benefits administration.
Responsibilities
- Monitor and supervise AI-driven triage and investigation workflows, validate agent output, and correct errors.
- Review high-severity and low-confidence cases escalated by agents and decide whether to contain, escalate, or close them.
- Serve as the overnight technical point of contact for incidents and coordinate with the SOC, IT, Infrastructure, and the on-call incident commander.
- Follow incident response runbooks and document actions clearly for the day shift.
- Build, test, and deploy automations, agent workflows, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
- Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based integrations where applicable.
- Tune detections, reduce false positives, and address gaps identified during live operations.
- Write and maintain scripts and code using version control, peer review, and documentation.
- Apply agent-action guardrails, including least-privilege access, human approval gates for impactful actions, and audit logging.
- Track and report agent quality metrics, including accuracy, escalation rate, false-positive and false-negative rates, mean time to triage, and mean time to respond.
- Run regression tests on agent behavior after model, prompt, or tooling changes.
- Identify unsafe or unreliable agent behavior and report it promptly to leadership.
- Provide written handoffs to day and evening shifts covering open items, risks, and changes.
- Mentor SOC analysts on agent-assisted investigation techniques and tooling.
- Contribute to post-incident reviews, tabletop exercises, and detection-engineering planning.
- Handle PII, PHI, and financial data in accordance with HealthEquity policy and applicable regulations.
Benefits
- Performance-based incentives.
- Medical, dental, and vision coverage.
- HSA contribution and match.
- Dependent care FSA match.
- At least 18 days of annual PTO and 13 paid holidays per year for full-time team members.
- Paid parental leave.
- 401(k) match.
- Personal and healthcare financial literacy programs.
- Ongoing education and tuition assistance.
- Gym and fitness reimbursement.
- Wellness program incentives.
- Required travel and accommodations for the onsite Trailhead onboarding session are covered.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Entry Level
Education Level
No Education Listed
