Senior SecOps Lead — AI Security & Incident (Remote)

Sword Health; United States; On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Comprehensive health, dental andvision

Life and AD&D Insurance

Equity shares

Discretionary PTO

401(k)

Remote‑first company

Paid company holidays

Free digital therapist

Flexible working hours

Job summary

Sword Health is seeking a Security Operations Lead to guide Sword’s SOC across a multi‑continent footprint. You’ll architect the SIEM, develop detection content, and own incident response in collaboration with engineering, IT, legal, and executives.

You will mentor engineers, drive automation, and shape security strategy to scale defenses while ensuring risk is managed with enterprise‑level metrics and governance.

Qualifications

• Public Trust clearance ability to obtain and maintain.
• 7+ years in Security Operations or equivalent.
• Proven automation/sAI-enabled SOC improvements with measurable impact.
• Hands-on SOC structuring, SIEM selection and runbooks.
• Strong incident response and forensics experience.
• Cloud experience in AWS and/or GCP with threat modeling knowledge.
• Fluent in building high-fidelity detections and MTTR reductions.

Responsibilities

• Serve as hands‑on technical lead for Sword’s SOC. Set direction for SIEM, detections, and incident response.
• Own the end‑to‑end SIEM architecture, data sources, and tuning aligned to MITRE ATT&CK.
• Mentor detection and response engineers; manage on‑call rotations and incidents.
• Define operating model and roadmap to scale SOC across a multi‑continent footprint.
• Drive AI‑and automation‑first security transformations with SOAR and LLM‑assisted triage.
• Lead high‑severity incident response and post‑incident reviews with cross‑functional partners.
• Run threat intelligence and hunting programs; translate TTPs into detections.
• Report SOC performance metrics and drive continuous improvement.
• Influence security across products and infrastructure from day one.

Skills

Public Trust Clearance

SOC leadership

SIEM expertise

Incident response

Automation & Scripting

Threat detection

Cloud security (AWS/GCP)

Team mentoring

Executive communication

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

Splunk

Sentinel

Chronicle

Elastic

Job description

Sword Health is seeking a Security Operations Lead to guide Sword’s SOC across a multi‑continent footprint. You’ll architect the SIEM, develop detection content, and own incident response in collaboration with engineering, IT, legal, and executives.

You will mentor engineers, drive automation, and shape security strategy to scale defenses while ensuring risk is managed with enterprise‑level metrics and governance.