{"id":2160662,"url":"https://alion.io/job/sword-health-security-operations-lead","title":"Security Operations Lead","company":{"id":591,"name":"Sword Health","domain":"swordhealth.com","url":"https://alion.io/company/sword-health","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":133978,"max":210537,"currency":"USD","period":"year","gross":null,"usd_annual":210537},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"Google SecOps","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-09-07T16:34:38Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-21T06:07:36Z","board_verified":true,"closed_at":null,"days_open":43,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":43},"description":"At Sword, we’re building AI to heal billions and unlock humanity’s full potential. In doing so, we’re pioneering AI Care, a fundamentally new approach to healthcare built for medical reasoning, safety, and real-time treatment, not generic technology applied after the fact. As both a clinical-centric frontier AI lab and an applied AI platform, Sword is reimagining how care is delivered at scale, removing traditional barriers like appointments, waiting rooms, and stigma so more people can access the care they need-and ultimately get back to lives lived in full.\nSince 2020, Sword has expanded across physical therapy, women’s health, cardiometabolic, and mental health, and is now moving beyond the session to a fully AI-native, 24/7 care program that brings physical activity, therapeutic exercise, psychotherapy, nutrition, and behavior change into one connected experience. More than 700,000 members across three continents have completed over 10 million AI sessions, helping 1,000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 42 clinical studies, 44+ patents, and more than $500 million raised from leading investors including Khosla Ventures, General Catalyst, and Founders Fund, Sword is defining a new standard for healthcare.\nAI Proficiency at Sword\nAI fluency is a core expectation at Sword. Every candidate is assessed against our three-level framework - be ready to share real examples of how AI is already part of how you work.\nExplorer (Level 1) - Uses AI daily to boost personal productivity\n\nBuilder (Level 2) - Creates workflows and tools that elevate the whole team\n\nIntegrator (Level 3) - Embeds AI into products and processes at scale\n\nEvery hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role.\nRole\nAs Security Operations Lead, you'll lead our SecOps squad and own how Sword detects, investigates, and responds to threats. You'll help structure how this function operates - setting the direction on SIEM architecture, detection engineering, and incident response - and use automation and AI to scale a focused team across a fast-growing, multi-continent footprint. You'll be a core voice in our security strategy, and the systems, processes, and culture you build will set the bar for how Sword protects 700,000+ members.\nTo get to know more about our Tech Stack, check here.\n\nWhat you’ll be doing\nServe as the hands-on technical lead for Sword’s Security Operations Center. Setting the technical direction - architecting the SIEM, engineering detection logic, executing incident response, and building the technical roadmap to scale our defenses as the company grows.\nOwn the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.\n\nLead the SOC/CSIRT team technically - mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as commander for major incidents.\n\nSet the strategy and technical direction for Sword’s Security Operations Center - defining the operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale them as the company grows.\n\nDrive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR, expand coverage, and let a lean team operate at enterprise scale.\n\nLead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, partnering with engineering, IT, legal, and executive stakeholders during critical events.\n\nRun the threat intelligence and threat hunting programs, converting emerging TTPs into new detections, proactive hardening, and informed risk decisions.\n\nAdvanced Incident Response & Threat Hunting: Lead end-to-end incident investigations in Google SecOps, leveraging complex telemetry correlation to proactively hunt for threats, contain active incidents, and drive root-cause remediation.\n\nDefine and report on SOC performance - MTTD, MTTR, coverage, automation rate, false-positive rate, on-call health - and use those metrics to drive measurable, continuous improvement.\n\nInfluence security architecture and engineering decisions across the company, ensuring detection, response, and recovery are built into new products, platforms, and infrastructure from day one.\n\nDetection & Automation Leadership: Architect, refine, and maintain custom YARA-L detection rules and SOAR playbooks in Google SecOps to automate triage, alert enrichment, and initial incident response.\n\nWhat you need to have\nRequired: Public Trust Clearance - Candidates must be able to obtain and maintain a US public trust clearance.\nBachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.\n\n7+ years experience in Security Operations\nProven experience scaling a SOC through automation and AI - SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection - with measurable impact on MTTR, coverage, or analyst leverage.\n\nHands-on experience structuring a SOC, either building one from the ground up or maturing one through significant transformation - SIEM selection, implementation or migration, detection engineering practice, runbook libraries, on-call rotations, and operating metrics.\n\nDeep SIEM expertise (Splunk, Sentinel, Google SecOps/Chronicle, Elastic, or similar) - ingestion architecture, detection-as-code, query optimization, and coverage-versus-cost tradeoffs.\nHighly preferred: Google SecOps/Chronicle \n\nPrior experience as the technical lead of a SOC or CSIRT team - owning the full incident response lifecycle, mentoring analysts and engineers, and acting as on-call/incident commander during major incidents.\n\nStrong incident response track record - leading high-severity investigations, root cause analysis, digital forensics, and post-incident reviews that produced durable improvements.\n\nSolid experience in cloud environments (AWS and/or GCP), with strong understanding of cloud-native threats and controls.\n\nStrong scripting and development skills (Python, Go, Bash, or similar) for building automation, integrations, and internal tooling.\n\nWorking knowledge of EDR/XDR, identity, and network detection telemetry, and how to combine signals into high-fidelity detections.\n\nFluency with security frameworks and standards (NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001) and the judgment to apply them pragmatically.\n\nBackground in threat modeling, adversary emulation, and risk-based alert tuning.\n\nExcellent communicator - able to brief executives during a Sev1, write a clear post-mortem, and translate technical risk into business language for non-technical audiences.\n\nProven track record of leading cross-functional efforts in high-pressure situations and fostering collaboration across InfoSec, IT, and engineering.\n\nForensics experience, investigating incidents and preserving digital evidence.\n\nPublic Trust Clearance\nCandidates must be able to obtain and maintain a US public trust clearance. \nPlease note that US citizenship is required to obtain and maintain a government security clearance.\n*The range below reflects base, variable, and equity for this role.\nThis is a starting point, not a ceiling - once someone joins and proves they're outlier talent, we adjust quickly to make sure their compensation matches their impact.\nJob titles may span more than one career level, so actual pay depends on skills, qualifications, experience, location, and market demand, among other factors. The range reflects base salary plus any variable, bonus, or sales incentives, and our estimate of the value of private company stock options where applicable. It's subject to change, and future stock value isn't guaranteed. Sword also offers additional benefits beyond total compensation.\nTotal Compensation Range\n$133,978—$210,537 USD\nCountry-specific benefits may vary and will be detailed separately.\nSword Health complies with applicable Federal and State civil rights laws and does not discriminate on the basis of Age, Ancestry, Color, Citizenship, Gender, Gender expression, Gender identity, Gender information, Marital status, Medical condition, National origin, Physical or mental disability, Pregnancy, Race, Religion, Caste, Sexual orientation, and Veteran status.","description_format":"text","description_chars":8510,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity","Stock options"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Physiotherapy & Rehabilitation","Medical AI","Digital Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-09T08:22:52Z"}],"visa":[],"liveness":{"score":50,"band":"ok","label":"Likely open","p_open":1,"p_active":0.903,"p_room":0.55,"age_days":43,"expected_fill_days":40,"reasons":["conf:3","velocity","win:tail"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":210537,"is_top_pay":true},"html_url":"https://alion.io/job/sword-health-security-operations-lead","json_url":"https://alion.io/job/sword-health-security-operations-lead.json","meta":{"generated_at":"2026-10-21T10:16:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14522,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":591},"rest":"https://alion.io/mcp/rest/get_company?id=591"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsword-health-security-operations-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsword-health-security-operations-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsword-health-security-operations-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sword-health-security-operations-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsword-health-security-operations-lead"}]}