Agentic SOC Cyber Engineer (AI)

Location: Remote within the United States; shift-based schedules include overnight or daytime 4/10 schedules in Mountain Time. Mandatory onsite Trailhead onboarding is held at headquarters once per quarter, with travel and accommodations covered.

Salary: $75,500–$96,000 per year, plus performance-based incentives and benefits.

Company

hirify.global provides financial and health information solutions that empower healthcare consumers and serves millions of members.

What you will do

• Monitor and supervise AI-driven triage and investigation workflows, validate agent output, and correct errors.
• Review escalated incidents and make containment, escalation, or closure decisions as the overnight technical point of contact.
• Build, test, and deploy automations, agent workflows, prompts, playbooks, and integrations across SIEM, SOAR, EDR, identity, email security, and cloud platforms.
• Tune detections, reduce false positives, maintain Python or comparable-language code, and use version control, peer review, and documentation.
• Apply least-privilege guardrails, approval gates, audit logging, regression testing, and quality metrics for AI agents.
• Coordinate shift handoffs, mentor SOC analysts, and contribute to post-incident reviews, tabletop exercises, and detection-engineering planning.

Requirements

• At least 2 years of experience in security operations, detection engineering, incident response, or security engineering.
• Hands-on experience with SIEM and SOAR platforms.
• Working knowledge of EDR/XDR, identity and access security, email security, and Azure, AWS, or both.
• Proficiency in Python or a comparable language, plus experience with APIs, JSON, and Git-based workflows.
• Practical experience with LLMs or AI agents in security or automation, including prompt design, tool use, and recognizing hallucinations or unreliable output.
• Knowledge of MITRE ATT&CK and the incident response lifecycle.
• Clear written and verbal communication, good independent judgment overnight, and reliable availability for the scheduled shift and escalations.

Nice to have

• Experience building or governing agentic workflows, including MCP, orchestration frameworks, or human-in-the-loop approval patterns.
• Experience with detection-as-code, infrastructure-as-code, or CI/CD for security content.
• Familiarity with HIPAA, SOC 2, PCI DSS, or similar regulated environments.
• Certifications such as GCIH, GCIA, GCFA, GCDA, Security+, CISSP, AZ-500, SC-200, or equivalent.
• Experience in financial services, healthcare, or benefits administration.

Culture & Benefits

• Remote role with 24/7 shift-based coverage and overnight technical ownership.
• Medical, dental, and vision coverage, HSA contribution and match, and dependent care FSA match.
• At least 18 days of annual PTO, 13 paid holidays, and paid parental leave for full-time team members.
• 401(k) match, education and tuition assistance, gym reimbursement, and wellness incentives.
• Travel and accommodations are covered for mandatory onsite Trailhead onboarding.

Hiring process

• Screening interviews may be transcribed with Microsoft Copilot; candidates may opt out.
• Certain interviews may use Pindrop Pulse for identity verification and interview security; candidates may opt out.
• Live interviews and assessments must reflect the candidate’s own work and thinking unless an exception is approved.