Security Operations Leader: AI-Driven Threat Detection

Swordhealth; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Sword Health seeks a Security Operations Lead to direct Sword's SecOps squad across a multi-continent footprint. You’ll set the direction for SIEM architecture, detection engineering, and incident response, and leverage automation and AI to scale security operations.

You’ll mentor engineers, lead high-severity incidents, drive threat intelligence, and align security with product roadmaps to protect 700,000+ members, partnering with engineering, IT, legal, and executives to embed security from

Qualifications

• Experience leading a Security Operations Center (SOC) team.
• Hands-on technical lead with SIEM and detection engineering experience.
• Familiarity with MITRE ATT&CK and threat modeling.

Responsibilities

• Serve as the hands-on technical lead for Sword’s Security Operations Center.
• Architect SIEM and detection content, and drive incident response.
• Mentor detection and response engineers; manage on-call and escalation models.
• Define operating model and roadmap to scale SOC capabilities.
• Drive AI- and automation-first security operations with SOAR and LLM-assisted triage.
• Lead high-severity incident response from detection to post-incident review.
• Oversee threat intelligence and hunting programs; translate TTPs into detections.
• Define SOC performance metrics and drive continuous improvement.
• Influence security architecture across products and infrastructure from day one.
• Establish and improve incident response playbooks and tabletop exercises.

Skills

SecOps leadership

SIEM architecture

Detection engineering

Incident response

MITRE ATT&CK

Threat hunting

Threat intelligence

Team mentorship

On-call escalation

Tools

SOAR playbooks

LLM-assisted triage

Security tools & workflow

Threat detection content

Job description

Sword Health seeks a Security Operations Lead to direct Sword's SecOps squad across a multi-continent footprint. You’ll set the direction for SIEM architecture, detection engineering, and incident response, and leverage automation and AI to scale security operations.

You’ll mentor engineers, lead high-severity incidents, drive threat intelligence, and align security with product roadmaps to protect 700,000+ members, partnering with engineering, IT, legal, and executives to embed security from