Remote Overnight AI SOC Engineer

HealthEquity, Inc.; United States; Remote; USD 76,000 - 96,000; Full time

Benefits offered by this job

Remote position

Trailhead onboarding

Health benefits

Paid time off

Home office stipend

Job summary

HealthEquity, Inc. is seeking an Agentic SOC Cyber Engineer to own overnight security operations. You will run, tune, and improve AI agents and automation for triage, enrichment, and investigation, stepping in as the human decision-maker when needed.

You will monitor AI-driven workflows, review high-severity cases, coordinate with SOC and IT, and follow runbooks. You’ll develop automations across SIEM/SOAR/EDR, refine prompts, and ensure least-privilege controls.

Qualifications

• 2+ years in security operations or incident response.
• Hands-on experience with SIEM and SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Cortex XSOAR, Tines, or similar).
• Working knowledge of EDR/XDR, identity and access security, email security, and cloud security (Azure, AWS, or both).
• Proficiency in Python or a comparable language, and experience with APIs, JSON, and Git-based workflows.
• Practical experience with LLMs or AI agents in a security or automation context, including prompt design, tool use, and recognizing hallucinations or unreliable output.
• Solid grasp of attack frameworks (MITRE ATT&CK) and incident response lifecycle.
• Clear written and verbal communication, and good judgment when working independently overnight.
• Ability to work the scheduled overnight shift reliably, and to be reachable for escalations as required.

Responsibilities

• Monitor and supervise AI-driven triage and investigation workflows, validating agent output and correcting errors.
• Review high-severity and low-confidence cases that agents elevate, and decide on containment, escalation, or closure.
• Serve as the overnight technical point of contact for incidents, coordinating with the SOC, IT, Infrastructure, and the on-call incident commander.
• Follow incident response runbooks and document actions clearly for the day shift.
• Build, test, and deploy automations, agent workflows, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
• Develop and refine agent prompts, tool definitions, and playbooks, including MCP-based tool integrations where applicable.
• Use overnight hours to tune detections, reduce false positives, and close gaps found during live operations.
• Write and maintain scripts and code (Python preferred) with version control, peer review, and documentation.
• Apply guardrails for agent actions: least-privilege access, human approval gates for impactful actions, and full audit logging.
• Track and report agent quality metrics such as accuracy, escalation rate, false-positive and false-negative rates, mean time to triage, and mean time to respond.
• Run regression tests on agent behavior after model, prompt, or tooling changes.
• Identify unsafe or unreliable agent behavior and report it promptly to leadership.
• Hand off cleanly to day and evening shifts with a written summary of open items, risks, and changes.
• Mentor SOC analysts on agent-assisted investigation techniques and tooling.
• Contribute to post-incident reviews, tabletop exercises, and detection-engineering planning.
• Handle sensitive data (PII, PHI, financial data) in line with HealthEquity policy and applicable regulations.

Skills

Security operations

Detection engineering

Incident response

Python

APIs

JSON

Git workflows

AI agents

MITRE ATT&CK

Communication

Tools

Splunk

Microsoft Sentinel

Chronicle

Cortex XSOAR

Tines

Azure

AWS

Job description

HealthEquity, Inc. is seeking an Agentic SOC Cyber Engineer to own overnight security operations. You will run, tune, and improve AI agents and automation for triage, enrichment, and investigation, stepping in as the human decision-maker when needed.

You will monitor AI-driven workflows, review high-severity cases, coordinate with SOC and IT, and follow runbooks. You’ll develop automations across SIEM/SOAR/EDR, refine prompts, and ensure least-privilege controls.