At Sword we’re building AI to heal billions and unlock humanity’s full potential. In doing so we’re pioneering AI Care a fundamentally new approach to healthcare built for medical reasoning safety and real-time treatment not generic technology applied after the fact. As both a clinical-centric frontier AI lab and an applied AI platform Sword is reimagining how care is delivered at scale removing traditional barriers like appointments waiting rooms and stigma so more people can access the care they need - and ultimately get back to lives lived in full.Since 2020 Sword has expanded across Musculoskeletal Women’s Health Cardiometabolic and Mental Health and is now moving beyond the session to a fully AI-native 24/7 care program that brings physical activity therapeutic exercise psychotherapy nutrition and behavior change into one connected experience. More than 1 million members across three continents have completed over 15 million AI sessions helping 2000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 59 clinical studies 43 patents and more than $500 million raised from leading investors including Khosla Ventures General Catalyst and Founders Fund Sword is defining a new standard for healthcare. Role As Security Operations Lead you'll lead our SecOps squad and own how Sword detects investigates and responds to threats. You'll help structure how this function operates — setting the direction on SIEM architecture detection engineering and incident response — and use automation and AI to scale a focused team across a fast-growing multi-continent footprint. You'll be a core voice in our security strategy and the systems processes and culture you build will set the bar for how Sword protects 700000+ members. To get to know more about our Tech Stack check here. ➡ ➡ AI Proficiency at Sword Health AI fluency is a core expectation at Sword Health. Every candidate is assessed against our three-level framework — be ready to share real examples of how AI is already part of how you work. Explorer (Level 1) — Uses AI daily to boost personal productivity Builder (Level 2) — Creates workflows and tools that elevate the whole team Integrator (Level 3) — Embeds AI into products and processes at scale Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role. What you’ll be doing ➡ Set the strategy and technical direction for Sword’s Security Operations Center — defining the operating model SIEM and detection architecture incident response capability and the roadmap to scale them as the company grows. Drive an AI- and automation-first transformation of security operations design SOAR playbooks agentic and LLM-assisted triage workflows and ML-driven detection to reduce MTTD/MTTR expand coverage and let a lean team operate at enterprise scale. Lead the SOC/CSIRT team technically — mentoring detection and response engineers raising the bar on investigations running on-call and escalation models and acting as commander for major incidents. Own the SIEM end-to-end (architecture data sources normalization retention cost and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model. Lead high-severity incident response from detection through containment eradication recovery and post-incident review partnering with engineering IT legal and executive stakeholders during critical events. Run the threat intelligence and threat hunting programs converting emerging TTPs into new detections proactive hardening and informed risk decisions. Define and report on SOC performance — MTTD MTTR coverage automation rate false-positive rate on-call health — and use those metrics to drive measurable continuous improvement. Influence security architecture and engineering decisions across the company ensuring detection response and recovery are built into new products platforms and infrastructure from day one. Establish and continuously improve incident response playbooks runbooks and tabletop exercises to ensure organizational readiness. What you need to have ➡ Required Public Trust Clearance - Candidates must be able to obtain and maintain a US public trust clearance. Bachelor’s degree in Computer Science Cybersecurity or equivalent professional experience. Proven experience scaling a SOC through automation and AI — SOAR hyperautomation LLM-assisted triage agentic workflows or ML-driven detection — with measurable impact on MTTR coverage or analyst leverage. Hands-on experience structuring a SOC either building one from the ground up or maturing one through significant transformation — SIEM selection implementation or migration detection engineering practice runbook libraries on-call rotations and operating metrics. Deep SIEM expertise (Splunk Sentinel Chronicle Elastic or similar) — ingestion architecture detection-as-code query optimization and coverage-versus-cost tradeoffs. Prior experience as the technical lead of a SOC or CSIRT team — owning the full incident response lifecycle mentoring analysts and engineers and acting as on-call/incident commander during major incidents. Strong incident response track record — leading high-severity investigations root cause analysis digital forensics and post-incident reviews that produced durable improvements. Solid experience in cloud environments (AWS and/or GCP) with strong understanding of cloud-native threats and controls. Strong scripting and development skills (Python Go Bash or similar) for building automation integrations and internal tooling. Working knowledge of EDR/XDR identity and network detection telemetry and how to combine signals into high-fidelity detections. Fluency with security frameworks and standards (NIST 800-61 CIS Controls MITRE ATT&CK ISO 27001) and the judgment to apply them pragmatically. Background in threat modeling adversary emulation and risk-based alert tuning. Excellent communicator — able to brief executives during a Sev1 write a clear post-mortem and translate technical risk into business language for non-technical audiences. Proven track record of leading cross-functional efforts in high-pressure situations and fostering collaboration across InfoSec IT and engineering. Forensics experience investigating incidents and preserving digital evidence. Public Trust Clearance ➡ Candidates must be able to obtain and maintain a US public trust clearance. Please note that US citizenship is required to obtain and maintain a government security clearance. ➡ This range includes base variable and equity. These compensation bands are just the starting point. Once someone joins and proves they’re outlier talent we adjust quickly to ensure their compensation aligns with their impact. Our job titles may span more than one career level. Actual pay is determined by skills qualifications experience location market demand and other factors. Compensation details listed in this posting reflect the base salary and any potential variable bonus or sales incentives and the Company’s estimation of the value of private company stock options if applicable. The pay range is subject to change future value of company stock options is not guaranteed and compensation may be modified in the future. In addition to our total compensation Sword offers a number of benefits as listed below. US - Sword Benefits & Perks • Comprehensive health dental and vision insurance • Life and AD&D Insurance • Financial advisory services • Supplemental Insurance Benefits (Accident Hospital and Critical Illness) • Health Savings Account • Equity shares • Discretionary PTO plan • Parental leave • 401(k) • Flexible working hours • Remote-first company • Paid company holidays • Free digital therapist for you and your family Eligibility Full-time employees regularly working 25+ hours per week Note Applicants must have a legal right to work in the United States and immigration or work visa sponsorship will not be provided. SWORD Health which includes SWORD Health Inc. and Sword Health Professionals (consisting of Sword Health Care Providers P.A. SWORD Health Care Providers of NJ P.C. SWORD Health Care Physical Therapy Providers of CA P.C.) complies with applicable Federal and State civil rights laws and does not discriminate on the basis of Age Ancestry Color Citizenship Gender Gender expression Gender identity Gender information Marital status Medical condition National origin Physical or mental disability Pregnancy Race Religion Caste Sexual orientation and Veteran status.