Sr Cyber Engineer
HealthEquity, Inc.1 day ago
Remote, United StatesSenior
Base Salary
$121k - $121k/yr
Responsibilities
- Build visibility and governance controls for AI applications, coding assistants, agents, and MCP servers, including unsanctioned tools.
- Design and tune DLP and runtime protections for AI prompts, uploads, responses, tool calls, applications, and agents.
- Define authentication, authorization, logging, and governed access paths for AI agents, tools, MCP servers, and LLM providers.
- Engineer and operate Cloudflare WAF, API Shield, Bot Management, DDoS protection, rate limiting, DNS, TLS, and Cloudflare One services.
- Engineer and operate Palo Alto Networks firewalls, Panorama, Strata Cloud Manager, Prisma Access, GlobalProtect, segmentation, security policies, and security profiles.
- Manage configuration as code and automate Cloudflare and Palo Alto Networks controls using Terraform, Ansible, Python, APIs, and Cloudflare Workers.
- Conduct adversarial testing for prompt injection, data exfiltration, tool misuse, and privilege abuse, and improve controls based on findings.
- Send platform telemetry to SIEM systems, build detections for AI-related activity, respond to incidents, and participate in on-call rotation.
- Track control coverage, enforcement, false positives, and remediation times; write design documents, runbooks, and standards; lead reviews and mentor engineers.
Requirements
- 7+ years of experience in security, network, or infrastructure engineering.
- Deep hands-on experience with either Palo Alto Networks or Cloudflare and production experience with the other platform.
- Hands-on production experience securing generative AI through AI governance, AI DLP, AI gateways or LLM firewalls, or securing LLM applications or agents.
- Working knowledge of prompt injection, sensitive information disclosure, excessive agency, tool misuse, OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
- Strong knowledge of TCP/IP, routing including BGP, DNS, TLS and PKI, HTTP, proxies, and IPsec.
- Experience with Terraform, Git, CI/CD, and Python for infrastructure as code and automation.
- Experience integrating SAML, OIDC, OAuth 2.0, and SCIM with an enterprise identity provider such as Microsoft Entra ID or Okta.
- Experience in a regulated environment handling sensitive health or financial data, such as HIPAA, PCI DSS, or SOC 2.
- Clear written communication for technical and non-technical audiences.
- Preferred Palo Alto Networks Next-Generation Firewall Engineer or Network Security Professional certification; an active PCNSE is also welcome.
- Preferred experience with Prisma AIRS, Cloudflare AI Gateway, AI Security for Apps, MCP server portals, Cloudflare Workers, AI agents, MCP servers, cloud network security, Cortex XSIAM, Splunk, Microsoft Sentinel, NIST AI Risk Management Framework, NIST AI 600-1, or ISO/IEC 42001.
Benefits
- Remote position with required in-person Trailhead onboarding held onsite at headquarters once per quarter; HealthEquity covers required travel and accommodations.
- Medical, dental, and vision coverage.
- HSA contribution and match and dependent care FSA match.
- Uncapped paid time off and paid parental leave.
- 401(k) match.
- Personal and healthcare financial literacy programs.
- Ongoing education and tuition assistance.
- Gym and fitness reimbursement and wellness program incentives.
- Performance-based incentives are eligible in addition to the compensation package.
Tech Stack
Categories
About HealthEquity, Inc.
HealthEquity builds a platform for administering Health Savings Accounts and other consumer-directed benefits (FSA, HRA, COBRA, commuter) for employers, advisors, and health plans. It earns fees for account administration and payments and custodial interest on HSA cash, and provides cards, portals, and integrations for members and partners. Founded in 2002 and headquartered in Draper, Utah, the public company trades on NASDAQ as HQY and serves over 16 million members.