HealthEquity
From HealthEquity's careers page
Status: listed on the employer's own careers page when we last checked (daily). Confirm on their site before applying.
As an Agentic SOC Cyber Engineer, you are the primary technical owner of our overnight security operations.
Our Mission
Our mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS. Come be part of remarkable.
Overview
How you can make a difference
HealthEquity protects the financial and health information of millions of members. Our Security Operations team works around the clock to detect, investigate, and contain threats to that data.
As an Agentic SOC Cyber Engineer, you are the primary technical owner of our overnight security operations. You will run, tune, and improve the AI agents and automation that handle first-line triage, enrichment, and investigation. You will also step in as the human decision-maker when an incident needs judgment, escalation, or containment.
Your work shortens detection and response times, reduces analyst fatigue, and keeps the 24/7 team consistent across all three shifts. Because you will often be the senior technical voice on shift, your decisions directly affect how quickly and safely HealthEquity responds to incidents.
Shift-Based AI SOC Engineering Roles (4/10 Schedules) --
Saturday to Tuesday: 1:00pm - 11:00pm MT
Wednesday to Saturday: 1:00pm - 11:00pm MT
Sunday to Wednesday: 10:00pm - 8:00am MT
Thursday to Sunday: 10:00pm - 8:00am MT
Operate the agentic SOC
Monitor and supervise AI-driven triage and investigation workflows, validating agent output and correcting errors.
Review high-severity and low-confidence cases that agents escalate, and decide on containment, escalation, or closure.
Serve as the overnight technical point of contact for incidents, coordinating with the SOC, IT, Infrastructure, and the on-call incident commander.
Follow incident response runbooks and document actions clearly for the day shift.
Engineer and improve
Build, test, and deploy automations, agent workflows, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based tool integrations where applicable.
Use overnight hours to tune detections, reduce false positives, and close gaps found during live operations.
Write and maintain scripts and code (Python preferred) with version control, peer review, and documentation.
Govern and measure
Apply guardrails for agent actions: least-privilege access, human approval gates for impactful actions, and full audit logging.
Track and report agent quality metrics such as accuracy, escalation rate, false-positive and false-negative rates, mean time to triage, and mean time to respond.
Run regression tests on agent behavior after model, prompt, or tooling changes.
Identify unsafe or unreliable agent behavior and report it promptly to leadership.
Support the 24/7 team
Hand off cleanly to day and evening shifts with a written summary of open items, risks, and changes.
Mentor SOC analysts on agent-assisted investigation techniques and tooling.
Contribute to post-incident reviews, tabletop exercises, and detection-engineering planning.
Handle sensitive data (PII, PHI, financial data) in line with HealthEquity policy and applicable regulations.
What you will need to be successful
Required
[2+] years in security operations, detection engineering, incident response, or security engineering.
Hands-on experience with SIEM and SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar).
Working knowledge of EDR/XDR, identity and access security, email security, and cloud security (Azure, AWS, or both).
Proficiency in Python or a comparable language, and experience with APIs, JSON, and Git-based workflows.
Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
Solid grasp of attack frameworks (MITRE ATT&CK) and incident response lifecycle.
Clear written and verbal communication, and good judgment when working independently overnight.
Ability to work the scheduled overnight shift reliably, and to be reachable for escalations as required.
Experience building or governing agentic workflows (e.g., MCP, orchestration frameworks, human-in-the-loop approval patterns).
Experience with detection-as-code, infrastructure-as-code, or CI/CD for security content.
Familiarity with regulated environments such as HIPAA, SOC 2, PCI DSS, or similar.
Certifications such as GCIH, GCIA, GCFA, GCDA, Security+, CISSP, AZ-500, SC-200, or equivalent.
Experience in financial services, healthcare, or benefits administration.
#LI-Remote
This is a remote position.
The actual compensation offer is determined based on job-related knowledge, education, skills, experience, and work location. This position will be eligible for performance-based incentives as part of the total compensation package, in addition to a full range of benefits including:
Medical, dental, and vision
HSA contribution and match
Dependent care FSA match
Full-time team members receive a minimum of 18 days of annual PTO and 13 paid holidays per year
Paid parental leave
401(k) match
Personal and healthcare financial literacy programs
Ongoing education & tuition assistance
Gym and fitness reimbursement
Wellness program incentives
Onboarding & Travel
This is a remote role, with an in-person onboarding training component. New team members must participate in Trailhead, HealthEquity’s immersive onboarding experience Trailhead is designed to foster meaningful connections, support your integration into the organization, and equip you with a strong understanding of our business. Trailhead participation is a key expectation of this role. Trailhead is held onsite at our headquarters once per quarter. HealthEquity covers all required travel and accommodations.
This role may begin with a virtual, self-paced onboarding experience, followed by a mandatory onsite Trailhead session at a later date.
HealthEquity is committed to providing reasonable accommodations to team members with qualifying disabilities. Should you be selected for this role and require an accommodation, we will put you in touch with our Benefits Team so you can begin the accommodation request process.
HealthEquity has a vision that by 2030 we will make HSAs as wide-spread and popular as retirement accounts. We are passionate about providing a solution that allows American families to connect health and wealth. Join us and discover a work experience where the person is valued more than the position. Click here to learn more.
You belong at HealthEquity!
HealthEquity, Inc. is an equal opportunity employer, and we are committed to being an employer where no matter your background or identity – you feel welcome and included. We ensure equal opportunity for all applicants and employees without regard to race, age, color, religion, sex, sexual orientation, gender identity, national origin, status as a qualified individual with a disability, veteran status, or other legally protected characteristics. HealthEquity is a drug-free workplace. For more information about our EEO policy, or about HealthEquity’s applicant disability accommodation, drug-free-workplace, background check, and E-Verify policies, please visit our Careers page.
HealthEquity uses Microsoft Copilot to transcribe screening interviews between candidates and their direct Talent Partner for note taking and interview summaries. By scheduling a screening interview with us, you consent to Microsoft Copilot’s AI technology recording and transcribing your interview with your Talent Partner. This information will be reviewed for accuracy and then used by HealthEquity to summarize the interview, ensure accuracy, and facilitate our hiring process. We take privacy seriously. You have the option to opt out. If you wish to opt out of this Microsoft Copilot transcription, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you, we will assume that you consent to the use of Microsoft Copilot.
HealthEquity uses Pindrop Pulse during certain interviews to support identity verification, interview security, and fraud prevention. By scheduling and participating in an interview where Pindrop Pulse is enabled, you acknowledge that Pindrop's technology may analyze information such as voice, video, device, network, and location-related signals to identify potential impersonation, deepfake activity, and other security risks. This information may be reviewed by HealthEquity's Talent Acquisition and Security teams to support a secure hiring process. All alerts and risk indicators are reviewed by trained personnel, and HealthEquity does not make hiring decisions based solely on automated analysis. We take privacy seriously. You have the option to opt out of Pindrop analysis. If you wish to opt out, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you before the interview, we will assume that you consent to HealthEquity's use of Pindrop Pulse for security verification purposes during the hiring process.
At HealthEquity, our goal is to save and improve lives by empowering healthcare consumers. This shared purpose inspires everything we do, including how we approach hiring. Our process is designed to get to know the real you: your skills, experiences, and potential to make a difference. We value honesty, originality, and the courage to do the right thing, even when it is not the easiest path. Showing up as your authentic self reflects these values and helps us build something truly remarkable together.
As AI is becoming a common tool throughout the application process, we want to be clear about its appropriate use at HealthEquity. Using AI to support resume writing, research, or interview preparation is perfectly acceptable, provided the content is accurate and genuinely represents your qualifications and skills. For other key parts of our interview process, however, it is important that the ideas, communication, and work you share reflect your own voice, experiences, and thinking. We ask that you participate in our live interviews and complete any assessments without AI assistance unless instructions explicitly indicate otherwise or a specific exception is discussed and approved in advance. This approach ensures fairness, celebrates your individuality, and allows your authentic perspective to shine. Behaviors that do not align with these guidelines may result in disqualification from the hiring process or termination of employment if later discovered. We appreciate your understanding and look forward to learning about the unique contributions only you can bring to HealthEquity.
HealthEquity is committed to your privacy as an applicant for employment. For information on our privacy policies and practices, please visit HealthEquity Privacy.
Scores your resume against this job the way resume scanners do: the job's hard and soft skills, searchability, recruiter tips and formatting.
Create a free account to see your score. Your resume stays in this browser until then, and we never store it.
Already a member? Sign in