Remote Overnight AI SOC Cyber Engineer

HealthEquity; United States; A distancia; USD 76.000 - 96.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Remote work

Health benefits

Paid time off

401(k) match

Trailhead onboarding

Descripción de la vacante

HealthEquity is seeking an Overnight SOC Cyber Engineer to own and optimize agentic security operations. You will run AI-driven triage, supervise incident handling, and coordinate with SOC and IT teams across cloud platforms.

You’ll build automations, refine prompts, and improve detections during overnight shifts, ensuring accurate containment decisions and thorough documentation for the day team.

Formación

• 2+ years in security operations, detection engineering, incident response, or security engineering.
• Hands-on experience with SIEM and SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar).
• Working knowledge of EDR/XDR, identity and access security, email security, and cloud security (Azure, AWS, or both).
• Proficiency in Python or a comparable language, and experience with APIs, JSON, and Git-based workflows.
• Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
• Solid grasp of attack frameworks (MITRE ATT&CK) and incident response lifecycle.
• Clear written and verbal communication, and good judgment when working independently overnight.
• Ability to work the scheduled overnight shift reliably, and to be reachable for escalations as required.

Responsabilidades

• Monitor and supervise AI-driven triage and investigation workflows, validating agent output and correcting errors.
• Review high-severity and low-confidence cases that agents elevate, and decide on containment, escalation, or closure.
• Serve as the overnight technical point of contact for incidents, coordinating with the SOC, IT, Infrastructure, and the on-call incident commander.
• Follow incident response runbooks and document actions clearly for the day shift.
• Build, test, and deploy automations, agent workflows, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
• Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based tool integrations where applicable.
• Use overnight hours to tune detections, reduce false positives, and close gaps found during live operations.
• Write and maintain scripts and code (Python preferred) with version control, peer review, and documentation.
• Track and report agent quality metrics such as accuracy, escalation rate, false-positive and false-negative rates, mean time to triage, and mean time to respond.

Conocimientos

Python

LLMs/AI agents

Incident response

Written and verbal communication

Herramientas

SIEM

SOAR

EDR/XDR

Azure

AWS

Descripción del empleo

HealthEquity is seeking an Overnight SOC Cyber Engineer to own and optimize agentic security operations. You will run AI-driven triage, supervise incident handling, and coordinate with SOC and IT teams across cloud platforms.

You’ll build automations, refine prompts, and improve detections during overnight shifts, ensuring accurate containment decisions and thorough documentation for the day team.