Security Operations Lead — Remote-First & Flexible Hours

Phoenix Court Group; United States; On-site; USD 134,000 - 211,000; Full time

Benefits offered by this job

Remote-first company

Comprehensive health benefits

Equity and PTO

Job summary

Sword Health is seeking a Security Operations Lead to guide Sword’s Security Operations Center, architect its SIEM, drive detection engineering, and coordinate incident response across a multi-continent footprint. You will mentor engineers, implement AI- and automation-first security workflows, and partner with engineering, IT, and legal teams to reduce risk while scaling defenses for 700,000+ members.

As the hands-on technical lead, you’ll set the direction for MITRE-aligned detections and

Qualifications

• Bachelor’s degree in CS/Cybersecurity or equivalent experience.
• 7+ years in Security Operations.
• Experience scaling a SOC through automation and AI with measurable MTTR impact.
• Hands-on SOC structuring: SIEM selection, detection engineering, runbooks.
• Strong incident response, forensics, and post-incident reviews.
• Cloud security experience in AWS and/or GCP.
• Fluency with NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001; risk-based alert tuning.
• Excellent communicator with executives and cross-functional teams.

Responsibilities

• Lead the hands-on technical SOC lead for Sword’s SOC, architect SIEM, develop detection content, and guide incident response.
• Own end-to-end SIEM: data sources, normalization, retention, cost, tuning; align to threat model.
• Mentor detection engineers, manage on-call rotations, and act as incident commander for major events.
• Define the operating model and roadmap to scale SOC capabilities across the company.
• Drive AI- and automation-first security transformations (SOAR, LLM-assisted triage, ML-driven detections).
• Lead high-severity investigations, root-cause analysis, and post-incident reviews.
• Lead threat intelligence and hunting programs; translate findings into detections and mitigations.
• Report SOC performance metrics to drive continuous improvement.
• Influence security architecture across products and infrastructure; embed security into development.

Skills

Public Trust Clearance

SIEM Architecture

Incident Response

Automation & AI

Python/Go scripting

Threat Hunting

Cloud Security

Leadership

Education

BSc in Computer Science / Cybersecurity

Tools

Splunk

Sentinel

Chronicle

Elastic

AWS

GCP

Job description

Sword Health is seeking a Security Operations Lead to guide Sword’s Security Operations Center, architect its SIEM, drive detection engineering, and coordinate incident response across a multi-continent footprint. You will mentor engineers, implement AI- and automation-first security workflows, and partner with engineering, IT, and legal teams to reduce risk while scaling defenses for 700,000+ members.

As the hands-on technical lead, you’ll set the direction for MITRE-aligned detections and