Overnight Associate AI SOC Engineer (Remote)

HealthEquity; Draper (UT); Remote; USD 76,000 - 96,000; Full time

Benefits offered by this job

Medical, dental, and vision

401(k) match

Generous PTO & holidays

Onboarding & Trailhead

Job summary

HealthEquity seeks an Associate Cyber Engineer to join our overnight Security Operations Center. You will run, tune, and improve AI-driven triage and investigation workflows, acting as the primary technical voice on shift for incidents.

You will engineer automations across SIEM, SOAR, EDR, and cloud platforms, refine prompts, and ensure least-privilege actions with full audit logging. Remote role with quarterly on-site onboarding at Trailhead.

Qualifications

• 2+ years in security operations, detection engineering, incident response, or security engineering.
• Hands-on experience with SIEM and SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar).
• Working knowledge of EDR/XDR, identity and access security, email security, and cloud security (Azure, AWS, or both).
• Proficiency in Python or a comparable language, and experience with APIs, JSON, and Git-based workflows.
• Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
• Solid grasp of attack frameworks (MITRE ATT&CK) and incident response lifecycle.
• Clear written and verbal communication, and good judgment when working independently overnight.
• Ability to work the scheduled overnight shift reliably, and to be reachable for escalations as required.

Responsibilities

• Operate the agentic SOC: monitor AI-driven triage, validate outputs, and correct errors.
• Review high-severity cases and decide on containment, escalation, or closure.
• Serve as overnight technical point of contact, coordinating with SOC, IT, and on-call incident commander.
• Follow incident runbooks and document actions for day shift.
• Engineer and improve automations, agent workflows, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
• Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based integrations.
• Tune detections, reduce false positives, and close gaps during live operations.
• Write and maintain scripts with version control, peer reviews, and documentation.

Skills

Security Operations

SIEM & SOAR

EDR/XDR

Python

LLMs & AI agents

MITRE ATT&CK

Communication

Overnight shift

Tools

Splunk

Microsoft Sentinel

Chronicle

Cortex XSOAR

Tines

Job description

HealthEquity seeks an Associate Cyber Engineer to join our overnight Security Operations Center. You will run, tune, and improve AI-driven triage and investigation workflows, acting as the primary technical voice on shift for incidents.

You will engineer automations across SIEM, SOAR, EDR, and cloud platforms, refine prompts, and ensure least-privilege actions with full audit logging. Remote role with quarterly on-site onboarding at Trailhead.