Security Operations Lead

🔥 9 minutes ago

🇺🇸 United States – Remote

💵 $134k - $210.5k / year

⏰ Full Time

🟠 Senior

🛡️ Security Operations

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Sword Health

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2015

🏥 Healthcare

☁️ SaaS

🤖 Artificial Intelligence

Healthcare • SaaS • Artificial Intelligence

Sword Health is a digital health company offering an AI Care platform that combines artificial intelligence with licensed clinicians to provide virtual care primarily for musculoskeletal (MSK) pain, women's health, cardiometabolic health, and mental health. Their platform includes AI-driven digital physical therapy for pain (Thrive), women's health program (Bloom), cardiometabolic program (Pulse), mental health support (Mind), and Predict, an AI engine to identify members at high risk for avoidable surgeries. Sword sells to employers, health plans, unions, consultants & brokers, and individuals, focusing on measurable cost savings, surgical avoidance, and improved clinical outcomes. They emphasize security, privacy, and clinical evidence with peer-reviewed studies and validated ROI.

📋 Description

• Lead Sword’s Security Operations Center as hands-on technical lead • Architect and own the SIEM, including data sources, normalization, retention, cost, tuning, and detection-as-code • Set SOC/CSIRT technical direction, operating model, incident response capability, and growth roadmap • Lead and mentor detection and response engineers; run on-call and escalation models • Command major incidents through containment, eradication, recovery, and post-incident review • Drive AI- and automation-first security operations using SOAR playbooks, agentic and LLM-assisted triage, and ML-driven detection • Run threat intelligence and threat hunting programs and convert emerging TTPs into detections and hardening • Investigate incidents in Google SecOps using telemetry correlation and root-cause remediation • Define and report SOC metrics including MTTD, MTTR, coverage, automation rate, false-positive rate, and on-call health • Influence security architecture and engineering decisions across the company • Architect and maintain YARA-L detection rules and SOAR playbooks in Google SecOps

🎯 Requirements

• Candidates must be able to obtain and maintain a US public trust clearance; US citizenship is required to obtain and maintain a government security clearance • Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience • 7+ years experience in Security Operations • Experience scaling a SOC through automation and AI, including SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection • Experience structuring a SOC through building or significant transformation, including SIEM selection, implementation or migration, detection engineering, runbooks, on-call rotations, and operating metrics • Deep SIEM expertise with Splunk, Sentinel, Google SecOps/Chronicle, Elastic, or similar • Experience as technical lead of a SOC or CSIRT team, owning incident response, mentoring, and major-incident command • Experience leading high-severity investigations, root cause analysis, digital forensics, and post-incident reviews • Experience in AWS and/or GCP cloud environments and cloud-native threats and controls • Strong scripting and development skills in Python, Go, Bash, or similar • Working knowledge of EDR/XDR, identity, and network detection telemetry • Fluency with NIST 800-61, CIS Controls, MITRE ATT&CK, and ISO 27001 • Background in threat modeling, adversary emulation, and risk-based alert tuning • Excellent communication skills for executive briefings, post-mortems, and translating technical risk • Track record leading cross-functional efforts in high-pressure situations • Forensics experience investigating incidents and preserving digital evidence

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume