Associate Cyber Engineer
HealthEquity, Inc.2 days ago
Remote, United StatesMid Level
Base Salary
$76k - $96k/yr
Responsibilities
- Monitor and supervise AI-driven triage and investigation workflows, validating agent output and correcting errors.
- Review escalated incidents and decide whether to contain, escalate, or close them.
- Coordinate overnight incident response with SOC, IT, Infrastructure, and the on-call incident commander.
- Build, test, deploy, and improve automations, agent workflows, playbooks, and integrations across security platforms.
- Develop agent prompts, tool definitions, and MCP-based integrations where applicable.
- Tune detections, reduce false positives, and identify operational gaps during live overnight operations.
- Write and maintain Python or comparable code using version control, peer review, and documentation.
- Apply least-privilege controls, human approval gates, and audit logging to agent actions.
- Track agent quality and response metrics, run regression tests, and report unsafe or unreliable behavior.
- Provide shift handoffs, mentor SOC analysts, and contribute to post-incident reviews, tabletop exercises, and detection-engineering planning.
- Handle PII, PHI, and financial data according to company policy and applicable regulations.
Requirements
- At least 2 years of experience in security operations, detection engineering, incident response, or security engineering.
- Hands-on experience with SIEM and SOAR platforms such as Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, or Tines.
- Working knowledge of EDR/XDR, identity and access security, email security, and cloud security using Azure, AWS, or both.
- Proficiency in Python or a comparable language, with experience using APIs, JSON, and Git-based workflows.
- Practical experience with LLMs or AI agents in security or automation, including prompt design, tool use, and identifying unreliable output.
- Knowledge of MITRE ATT&CK and the incident response lifecycle.
- Ability to work the scheduled overnight shift reliably and remain reachable for escalations.
- Preferred experience building or governing agentic workflows, including MCP, orchestration frameworks, and human-in-the-loop approval patterns.
- Preferred experience with detection-as-code, infrastructure-as-code, or CI/CD for security content.
- Familiarity with HIPAA, SOC 2, PCI DSS, or similar regulated environments.
- Certifications such as GCIH, GCIA, GCFA, GCDA, Security+, CISSP, AZ-500, SC-200, or equivalent are preferred.
- Experience in financial services, healthcare, or benefits administration is preferred.
Benefits
- Remote position with overnight 4/10 schedule options: Sunday-Wednesday 9 PM-7 AM MT, Wednesday-Saturday 9 PM-7 AM MT, or Wednesday-Saturday 9 AM-7 PM MT.
- In-person onboarding is required through the quarterly onsite Trailhead program; HealthEquity covers required travel and accommodations.
- Medical, dental, and vision coverage.
- HSA contribution and match and dependent care FSA match.
- At least 18 days of annual PTO and 13 paid holidays for full-time team members.
- Paid parental leave and 401(k) match.
- Education and tuition assistance, gym and fitness reimbursement, wellness incentives, and financial literacy programs.
About HealthEquity, Inc.
HealthEquity builds a platform for administering Health Savings Accounts and other consumer-directed benefits (FSA, HRA, COBRA, commuter) for employers, advisors, and health plans. It earns fees for account administration and payments and custodial interest on HSA cash, and provides cards, portals, and integrations for members and partners. Founded in 2002 and headquartered in Draper, Utah, the public company trades on NASDAQ as HQY and serves over 16 million members.