Security Operations Lead: AI-Driven SOC & Response

Sword Health; United States; On-site; USD 134,000 - 211,000; Full time

Job summary

Sword Health seeks a Security Operations Lead to helm the SOC, architect SIEM and detection content (MITRE-aligned), and drive AI- and automation-first security initiatives across a global footprint. You will mentor engineers, manage incident response, and partner with engineering, IT, and legal to elevate security posture.

You will define operating models, build scalable processes, and report on MTTD/MTTR metrics while ensuring investigations and post-incident reviews translate into durable

Qualifications

• Public Trust Clearance required: must be able to obtain/maintain a US public trust clearance.
• Bachelor's degree in Computer Science, Cybersecurity, or equivalent professional experience.
• 7+ years experience in Security Operations.
• Proven experience scaling a SOC through automation and AI with measurable impact on MTTR, coverage, or analyst leverage.
• Hands-on experience structuring a SOC and operating metrics.
• Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic) and detection engineering.
• Experience leading SOC/CSIRT teams including on-call/incident commander duties.
• Cloud security experience (AWS/GCP).
• Strong scripting/development skills for automation and tooling.
• Excellent communicator with executives and cross-functional collaboration.
• Forensics experience.

Responsibilities

• Serve as hands-on technical lead for Sword's Security Operations Center and set the technical direction.
• Own the SIEM end-to-end architecture and detection-content OKR aligned to MITRE ATT&CK.
• Lead the SOC/CSIRT team technically and mentor engineers.
• Define operating model and roadmaps for SIEM and detection architecture.
• Drive AI- and automation-first transformation of security operations with SOAR and ML-driven detection.
• Lead high-severity incident response and post-incident reviews with cross-functional partners.
• Run threat intelligence and threat hunting programs; translate TTPs into detections.
• Define SOC performance metrics and drive continuous improvement.
• Influence security architecture across products and infrastructure from day one.
• Develop and maintain YARA-L detection rules and SOAR playbooks.

Skills

Public Trust Clearance

Experience in Security Operations

Automation/AI for SOC

SOC structure/leadership

Incident response leadership

Cloud security (AWS/GCP)

Scripting/Development (Python/Go/Bash)

Communication with executives

Forensics experience

Education

Bachelor's degree in Computer Science, Cybersecurity, or equivalent

Tools

Splunk

Microsoft Sentinel

Google SecOps/Chronicle

Elastic

Job description

Sword Health seeks a Security Operations Lead to helm the SOC, architect SIEM and detection content (MITRE-aligned), and drive AI- and automation-first security initiatives across a global footprint. You will mentor engineers, manage incident response, and partner with engineering, IT, and legal to elevate security posture.

You will define operating models, build scalable processes, and report on MTTD/MTTR metrics while ensuring investigations and post-incident reviews translate into durable