Security Operations Lead (SecOps)

Swordhealth; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Sword Health seeks a Security Operations Lead to direct Sword's SecOps squad across a multi-continent footprint. You’ll set the direction for SIEM architecture, detection engineering, and incident response, and leverage automation and AI to scale security operations.

You’ll mentor engineers, lead high-severity incidents, drive threat intelligence, and align security with product roadmaps to protect 700,000+ members, partnering with engineering, IT, legal, and executives to embed security from

Qualifications

• Experience leading a Security Operations Center (SOC) team.
• Hands-on technical lead with SIEM and detection engineering experience.
• Familiarity with MITRE ATT&CK and threat modeling.

Responsibilities

• Serve as the hands-on technical lead for Sword’s Security Operations Center.
• Architect SIEM and detection content, and drive incident response.
• Mentor detection and response engineers; manage on-call and escalation models.
• Define operating model and roadmap to scale SOC capabilities.
• Drive AI- and automation-first security operations with SOAR and LLM-assisted triage.
• Lead high-severity incident response from detection to post-incident review.
• Oversee threat intelligence and hunting programs; translate TTPs into detections.
• Define SOC performance metrics and drive continuous improvement.
• Influence security architecture across products and infrastructure from day one.
• Establish and improve incident response playbooks and tabletop exercises.

Skills

SecOps leadership

SIEM architecture

Detection engineering

Incident response

MITRE ATT&CK

Threat hunting

Threat intelligence

Team mentorship

On-call escalation

Tools

SOAR playbooks

LLM-assisted triage

Security tools & workflow

Threat detection content

Job description

At Sword, we’re building AI to heal billions and unlock humanity’s full potential. In doing so, we’re pioneering AI Care, a fundamentally new approach to healthcare built for medical reasoning, safety, and real-time treatment, not generic technology applied after the fact. As both a clinical-centric frontier AI lab and an applied AI platform, Sword is reimagining how care is delivered at scale, removing traditional barriers like appointments, waiting rooms, and stigma so more people can access the care they need - and ultimately get back to lives lived in full.

Since 2020, Sword has expanded across Musculoskeletal, Women’s Health, Cardiometabolic, and Mental Health, and is now moving beyond the session to a fully AI-native, 24/7 care program that brings physical activity, therapeutic exercise, psychotherapy, nutrition, and behavior change into one connected experience. More than 1 million members across three continents have completed over 15 million AI sessions, helping 2,000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 59 clinical studies, 43 patents, and more than $500 million raised from leading investors including Khosla Ventures, General Catalyst, and Founders Fund, Sword is defining a new standard for healthcare.

Role

As Security Operations Lead, you'll lead our SecOps squad and own how Sword detects, investigates, and responds to threats. You'll help structure how this function operates — setting the direction on SIEM architecture, detection engineering, and incident response — and use automation and AI to scale a focused team across a fast-growing, multi-continent footprint. You'll be a core voice in our security strategy, and the systems, processes, and culture you build will set the bar for how Sword protects 700,000+ members.

To get to know more about our Tech Stack, check here.

AI Proficiency at Sword Health

AI fluency is a core expectation at Sword Health. Every candidate is assessed against our three-level framework — be ready to share real examples of how AI is already part of how you work.

• Explorer (Level 1) — Uses AI daily to boost personal productivity
• Builder (Level 2) — Creates workflows and tools that elevate the whole team
• Integrator (Level 3) — Embeds AI into products and processes at scale

Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role.

• Serve as the hands‑on technical lead for Sword’s Security Operations Center. Setting the technical direction — architecting the SIEM, engineering detection logic, executing incident response, and building the technical roadmap to scale our defenses as the company grows.
• Own the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.
• Lead the SOC/CSIRT team technically — mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as commander for major incidents.
• Set the strategy and technical direction for Sword’s Security Operations Center — defining the operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale them as the company grows.
• Drive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR, expand coverage, and let a lean team operate at enterprise scale.
• Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, partnering with engineering, IT, legal, and executive stakeholders during critical events.
• Run the threat intelligence and threat hunting programs, converting emerging TTPs into new detections, proactive hardening, and informed risk decisions.
• Define and report on SOC performance — MTTD, MTTR, coverage, automation rate, false-positive rate, on-call health — and use those metrics to drive measurable, continuous improvement.
• Influence security architecture and engineering decisions across the company, ensuring detection, response, and recovery are built into new products, platforms, and infrastructure from day one.
• Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to ensure organizational readiness.

• Mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mandatory mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand mand