Remote Overnight AI SOC Engineer

HealthEquity, Inc.; Mission (TX); Remote; USD 76,000 - 96,000; Full time

Benefits offered by this job

Medical, dental, and vision

HSA contribution and match

PTO and holidays

Paid parental leave

401(k) match

Education tuition assistance

Gym and wellness reimbursement

Job summary

HealthEquity, Inc. seeks an overnight SOC Cyber Engineer to own and optimize agentic security operations across SIEM, SOAR, and EDR platforms. You will tune detections, review high-severity cases, and coordinate with SOC and IT teams.

The role emphasizes building automations, refining prompts, and maintaining secure, auditable processes while handling sensitive data in a 24/7 remote environment. Experience with AI agents and secure coding is required.

Qualifications

• 2+ years in security operations, detection engineering, incident response, or security engineering.
• Hands-on experience with SIEM and SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar).
• Working knowledge of EDR/XDR, identity and access security, email security, and cloud security (Azure, AWS, or both).
• Proficiency in Python or a comparable language, and experience with APIs, JSON, and Git-based workflows.
• Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
• Solid grasp of attack frameworks (MITRE ATT&CK) and incident response lifecycle.
• Clear written and verbal communication, and good judgment when working independently overnight.
• Ability to work the scheduled overnight shift reliably, and to be reachable for escalations as required.

Responsibilities

• Operate the agentic SOC, monitoring AI-driven triage and investigation workflows and validating outputs.
• Review high-severity/low-confidence cases and decide containment, escalation, or closure.
• Serve as the overnight technical point of contact for incidents with cross-team coordination.
• Follow incident response runbooks and document actions clearly for the day shift.
• Engineer and improve automations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
• Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based integrations.
• Tune detections during overnight hours to reduce false positives and close coverage gaps.
• Write and maintain scripts with version control and documentation.
• Govern and measure agent actions with least-privilege, approvals, and full audit logging.
• Track agent quality metrics and run regression tests after model/tooling changes.
• Identify unsafe agent behavior and report to leadership.
• Mentor SOC analysts on investigation techniques and tooling.
• Support the 24/7 team with handoffs, open-risk summaries, and changes.

Skills

Security operations

Threat detection

SIEM

SOAR

EDR/XDR

Python

LLMs

MITRE ATT&CK

Tools

Identity security

Cloud security

Job description

HealthEquity, Inc. seeks an overnight SOC Cyber Engineer to own and optimize agentic security operations across SIEM, SOAR, and EDR platforms. You will tune detections, review high-severity cases, and coordinate with SOC and IT teams.

The role emphasizes building automations, refining prompts, and maintaining secure, auditable processes while handling sensitive data in a 24/7 remote environment. Experience with AI agents and secure coding is required.