134K–211K USD / year
Security Operations Lead
OperationsWorkplace — United States
Published on 2026-10-02
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead Sword’s security operations function, shaping its SIEM architecture, detection engineering, and incident response capabilities. Build an automation- and AI-enabled SOC that can scale across the company’s global footprint while protecting its members and systems.
About the company
Sword Health is a digital musculoskeletal care company that helps employers and health plans deliver AI-powered physical therapy and related care programs.
The team
Security Operations Center (SOC/CSIRT)
Stack
Google SecOpsGoogle ChronicleYARA-LSOARAWSGCPSplunkMicrosoft Sentinel
What you'll do
- Set the technical direction and roadmap for the SOC, SIEM, detection engineering, and incident response.
- Own SIEM architecture, data ingestion, normalization, retention, cost, and tuning; develop detection-as-code aligned with MITRE ATT&CK.
- Technically lead and mentor the SOC/CSIRT team, including on-call operations and major incident command.
- Build SOAR playbooks and AI-, agentic-, and ML-assisted workflows to improve triage, detection coverage, and response times.
- Lead high-severity incident response from detection through recovery and post-incident review.
- Run threat intelligence and threat hunting programs, translating emerging tactics into detections and hardening.
- Define and report SOC metrics, including MTTD, MTTR, coverage, automation, false positives, and on-call health.
- Influence security architecture and engineering decisions to embed detection, response, and recovery into products and infrastructure.
What we're looking for
- Able to obtain and maintain a US Public Trust clearance; US citizenship is required.
- 7+ years of security operations experience and a bachelor’s degree in computer science, cybersecurity, or equivalent experience.
- Experience building or significantly maturing a SOC, including SIEM implementation or migration, detection engineering, runbooks, on-call rotations, and operating metrics.
- Deep SIEM expertise, including ingestion architecture, detection-as-code, query optimization, and cost-versus-coverage decisions.
- Experience leading a SOC or CSIRT, mentoring practitioners, and owning incident response and major incident command.
- Strong incident response, root-cause analysis, digital forensics, and post-incident review experience.
- Experience with AWS and/or GCP, cloud threats, and EDR/XDR, identity, and network telemetry.
- Scripting or development skills in Python, Go, Bash, or similar; knowledge of NIST 800-61, CIS Controls, MITRE ATT&CK, and ISO 27001.
Nice to have
- Hands-on experience with Google SecOps/Chronicle.
- Experience authoring YARA-L detection rules and SOAR playbooks.