Senior Security Operations Engineer

About this role

Protect Sword’s cloud infrastructure and applications by improving security detection, incident response, and threat-hunting capabilities. The role also uses AI to automate and improve SOC workflows while maintaining human validation and operational controls.

About the company

Sword Health is a digital musculoskeletal care company that helps employers and health plans deliver AI-powered physical therapy and related care programs.

Stack

What you'll do

• Improve detection and alerting controls to reduce noise and support rapid response.
• Create and maintain YARA-L detection rules and SOAR playbooks in Google SecOps.
• Prioritize alerts using business impact and threat context.
• Lead incident investigations, threat hunting, containment, and root-cause remediation.
• Coordinate incident handling across engineering, IT, and business teams.
• Track incident-response metrics and continuously improve operational readiness.
• Use AI to automate alert triage, enrichment, classification, investigation, and reporting workflows.
• Maintain AI-assisted runbooks with auditability and human validation.

What we're looking for

• Be eligible to obtain and maintain a US Public Trust clearance.
• Bachelor’s degree in computer science, cybersecurity, or equivalent professional experience.
• Experience with cloud environments and cloud-native threats.
• Proficiency in Python, Bash, or similar scripting languages.
• Hands-on experience with SIEM, SOAR, EDR/XDR, and log-management tools.
• Knowledge of incident containment, eradication, and digital forensics.
• Familiarity with NIST 800-61, CIS Controls, MITRE ATT&CK, or ISO 27001.
• Experience with threat modeling, adversary emulation, and risk-based alert tuning.

Nice to have

• Google SecOps/Chronicle experience