Principal Security Engineer

HealthEquity•Remote,

9d•$133,000 - $173,000•Remote

About The Position

As a Principal Security Engineer, AI Offensive Security, you build and operate agentic systems that discover, validate, and help remediate vulnerabilities across HealthEquity. You combine strong software engineering skills with offensive security expertise to automate security testing and vulnerability workflows across web applications and modern cloud environments. You are an experienced builder who translates offensive security techniques into scalable automation. Working within established architectural patterns and security standards, you develop and enhance agentic capabilities that improve the speed, consistency, and coverage of vulnerability discovery and remediation. The systems you build help move validated findings from identification through remediation while reducing manual effort and increasing the effectiveness of the security program.

Requirements

This role requires hands-on experience building and operating AI-enabled automation combined with practical offensive security expertise in modern web application and cloud environments.
Experience building and operating production software, automation platforms, or security tooling.
Experience developing or extending AI-enabled workflows, agentic systems, or LLM-powered automation solutions.
Familiarity with agent frameworks, orchestration patterns, structured context, tool integration, and evaluation approaches.
Ability to document technical processes and automate repetitive workflows through software and AI-enabled solutions.
Proficiency developing software and integrations using APIs, cloud services, automation frameworks, and data pipelines.
Experience using AI-assisted development tools and LLM technologies to accelerate engineering and automation outcomes.
Understanding of the strengths, limitations, and operational considerations associated with production AI systems.
Hands-on experience testing modern web applications, APIs, and cloud environments.
Knowledge of OWASP Top 10 vulnerabilities, authentication and authorization weaknesses, business logic flaws, and exploit validation techniques.
Experience assessing cloud environments including identity, access management, configuration risks, and common cloud attack paths.
Familiarity with application security testing, vulnerability analysis, and remediation workflows.
Working knowledge of offensive security tools and methodologies used to identify and validate security weaknesses.
10+ years of experience in software engineering, offensive security, penetration testing, application security, or a closely related discipline.
Demonstrated experience delivering and supporting production software or automation solutions.
Experience working within cross-functional engineering or security teams.
Ability to explain technical risks and findings to both technical and non-technical audiences.
Sound judgment in balancing security requirements with engineering practicality and business needs.

Nice To Haves

Bachelor's Degree in Computer Science, Security or other technical degree; Master's degree preferred
Experience integrating security capabilities into CI/CD pipelines and developer workflows.
Experience in healthcare, financial services, or another highly regulated industry.
Working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks.
Relevant industry certifications such as OSCP, OSWE, cloud security certifications, or comparable offensive security credentials.

Responsibilities

Build and maintain offensive security agents that automate reconnaissance, enumeration, vulnerability validation, and other security testing activities across web and cloud environments.
Develop agentic workflows that support attack surface management and vulnerability management programs.
Implement automation that combines deterministic components (APIs, infrastructure-as-code, data pipelines) with non-deterministic, LLM-driven steps, choosing the right approach for each.
Build integrations between security tooling, ticketing platforms, asset inventories, CI/CD pipelines, and threat intelligence sources.
Apply established architectural patterns, governance requirements, and human-in-the-loop controls when developing AI-enabled security capabilities.
Validate findings generated by automated systems, reproduce vulnerabilities, and assist with risk assessment and prioritization.
Develop monitoring, testing, and evaluation capabilities that improve the reliability and effectiveness of agentic systems.
Support penetration testing and purple-team activities focused on validating vulnerabilities, controls, and remediation efforts.
Partner with Cyber Threat Intelligence, Security Engineering, and Vulnerability Management teams to improve detection and response capabilities.
Raise technical concerns, recommend improvements, and contribute to the evolution of team tools, practices, and automation capabilities.