Sr Cyber Engineer

HealthEquity•Remote,

2d•Remote

About The Position

HealthEquity is hiring a hands-on senior cybersecurity engineer to build and operate defenses for generative AI applications, agents, and related services, while also owning core engineering for the company’s Cloudflare and Palo Alto Networks security platforms. The engineer will design, deploy, and run controls in production, addressing risks such as prompt injection, sensitive data exposure, excessive agent access, and misuse of tools. The role includes governing AI use across the company; applying data loss prevention to AI prompts, uploads, responses, and tool calls; protecting company-built AI applications; securing agent authentication and access to internal systems; routing model-provider traffic through managed gateways; and working with product and fraud teams on AI crawlers and agents interacting with member-facing sites. It also involves adversarial testing, early security consultation on AI use cases, and publishing secure reference architectures. The engineer will operate Cloudflare services for application, API, bot, DDoS, DNS, TLS, and zero-trust security, and will manage configuration as code. The role also owns Palo Alto Networks firewalls and related management and access platforms, including segmentation, security policies, upgrades, lifecycle management, and automation. The engineer will send telemetry to the SIEM, develop detections, respond to incidents, participate in the on-call rotation, track control effectiveness, write technical documentation, lead design reviews, and mentor other engineers. This is a remote position with mandatory in-person onboarding at HealthEquity headquarters once per quarter; required travel and accommodations are covered. The role may start with virtual, self-paced onboarding before a later required onsite session.

Requirements

At least 7 years of experience in security, network, or infrastructure engineering.
Deep hands-on engineering experience with either Palo Alto Networks (PAN-OS, Panorama or Strata Cloud Manager, and GlobalProtect or Prisma Access) or Cloudflare (WAF, API Shield, Bot Management, and Cloudflare One), plus production experience with the other platform.
Hands-on experience securing generative AI in production, such as controlling AI application use, applying DLP to AI traffic, deploying an AI gateway or LLM firewall, or securing an LLM-based application or agent.
Working knowledge of AI-specific threats, including direct and indirect prompt injection, sensitive information disclosure, excessive agency, and tool misuse, and of the OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
Strong networking fundamentals, including TCP/IP, routing (including BGP), DNS, TLS and PKI, HTTP, proxies, and IPsec.
Infrastructure-as-code and automation experience with Terraform, Git, CI/CD, and Python.
Experience integrating SAML, OIDC, OAuth 2.0, and SCIM with an enterprise identity provider such as Microsoft Entra ID or Okta.
Experience in a regulated environment handling sensitive health or financial data, such as under HIPAA, PCI DSS, or SOC 2.
Clear written communication for technical and non-technical audiences.

Nice To Haves

Palo Alto Networks Next-Generation Firewall Engineer or Network Security Professional certification; an active PCNSE is also welcome.
Hands-on experience with Prisma AIRS, Cloudflare AI Gateway, AI Security for Apps, or MCP server portals.
Development experience on Cloudflare Workers using JavaScript or TypeScript.
Experience building or securing AI agents and MCP servers.
Cloud network security experience in AWS, Azure, or Google Cloud.
Detection engineering experience with Cortex XSIAM, Splunk, Microsoft Sentinel, or a similar platform.
Familiarity with the NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1), or ISO/IEC 42001.

Responsibilities

Discover and govern AI applications, coding assistants, agents, and MCP servers, including unsanctioned tools, and apply risk-based allow, monitor, isolate, or block policies.
Design and tune data loss prevention controls for AI prompts, file uploads, responses, and agent tool calls to protect member PHI, PII, and financial data while allowing legitimate work.
Deploy runtime protections and audit logging for production AI applications and agents, including prompt injection and jailbreak detection, sensitive data detection, topic and output controls, and token-based rate limiting.
Define AI-agent authentication, access to tools and data, and logging and attribution of tool calls; govern approved MCP server paths and block bypasses.
Route LLM provider traffic through managed AI gateways for policy enforcement, usage and cost visibility, and credential protection; keep provider API keys in a secrets vault.
Work with product and fraud prevention teams to establish and enforce how member and employer sites and APIs handle AI crawlers and agents using Cloudflare bot controls.
Conduct adversarial testing of AI applications and agents and use findings to improve controls and detections.
Partner with Application Security, Architecture, Data, Privacy, and Compliance to review proposed AI use cases, publish secure reference architectures, and implement risk requirements as controls.
Engineer and operate Cloudflare services, including WAF, API Shield, Bot Management, DDoS protection, rate limiting, DNS, TLS, and Cloudflare One services.
Protect member and employer applications and APIs from account takeover, credential stuffing, scraping, and other automated abuse.
Manage Cloudflare configuration as code using Terraform, peer review, and CI/CD, and build custom controls with Cloudflare Workers when native features are insufficient.
Engineer and operate Palo Alto Networks next-generation firewalls, Panorama and Strata Cloud Manager, Prisma Access, and GlobalProtect.
Design and maintain network segmentation, App-ID and User-ID policies, decryption policies, and security profiles for Palo Alto Networks security services.
Lead firewall policy hygiene and lifecycle work, including PAN-OS upgrades, high availability, and responses to vendor security advisories.
Automate Palo Alto Networks operations using APIs, Terraform, Ansible, and Python.
Send Cloudflare and Palo Alto Networks telemetry to the SIEM and build detections for AI-related activity and unusual agent behavior.
Serve as an escalation point for incidents involving edge, network, and AI controls, and participate in the on-call rotation.
Track and report control coverage, enforcement rates, false-positive rates, and time to remediate.
Write design documents, runbooks, and standards; lead design reviews and mentor other engineers.