Since 2020, Sword has expanded across Musculoskeletal, Women’s Health, Cardiometabolic, and Mental Health, and is now moving beyond the session to a fully AI-native, 24/7 care program that brings physical activity, therapeutic exercise, psychotherapy, nutrition, and behavior change into one connected experience. More than 1 million members across three continents have completed over 15 million AI sessions, helping 2,000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 59 clinical studies, 43 patents, and more than $500 million raised from leading investors including Khosla Ventures, General Catalyst, and Founders Fund, Sword is defining a new standard for healthcare.
Role
As Security Operations Lead, you'll lead our SecOps squad and own how Sword detects, investigates, and responds to threats. You'll help structure how this function operates — setting the direction on SIEM architecture, detection engineering, and incident response — and use automation and AI to scale a focused team across a fast-growing, multi-continent footprint. You'll be a core voice in our security strategy, and the systems, processes, and culture you build will set the bar for how Sword protects 700,000+ members.
To get to know more about our Tech Stack, check here.
Explorer (Level 1) — Uses AI daily to boost personal productivity
Builder (Level 2) — Creates workflows and tools that elevate the whole team
Integrator (Level 3) — Embeds AI into products and processes at scale
AI fluency is a core expectation at Sword Health. Every candidate is assessed against our three-level framework — be ready to share real examples of how AI is already part of how you work.
Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role.
What you’ll be doing
- Serve as the hands-on technical lead for Sword’s Security Operations Center. Setting the technical direction — architecting the SIEM, engineering detection logic, executing incident response, and building the technical roadmap to scale our defenses as the company grows.
Own the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.
Lead the SOC/CSIRT team technically — mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as commander for major incidents.
Set the strategy and technical direction for Sword’s Security Operations Center — defining the operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale them as the company grows.
Drive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR, expand coverage, and let a lean team operate at enterprise scale.
Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, partnering with engineering, IT, legal, and executive stakeholders during critical events.
Run the threat intelligence and threat hunting programs, converting emerging TTPs into new detections, proactive hardening, and informed risk decisions.
Define and report on SOC performance — MTTD, MTTR, coverage, automation rate, false-positive rate, on-call health — and use those metrics to drive measurable, continuous improvement.
Influence security architecture and engineering decisions across the company, ensuring detection, response, and recovery are built into new products, platforms, and infrastructure from day one.
Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to ensure organizational readiness.
What you need to have
- Required: Public Trust Clearance - Candidates must be able to obtain and maintain a US public trust clearance.
Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
- 7+ years experience in Security Operations
Proven experience scaling a SOC through automation and AI — SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection — with measurable impact on MTTR, coverage, or analyst leverage.
Hands-on experience structuring a SOC, either building one from the ground up or maturing one through significant transformation — SIEM selection, implementation or migration, detection engineering practice, runbook libraries, on-call rotations, and operating metrics.
Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic, or similar) — ingestion architecture, detection-as-code, query optimization, and coverage-versus-cost tradeoffs.
Prior experience as the technical lead of a SOC or CSIRT team — owning the full incident response lifecycle, mentoring analysts and engineers, and acting as on-call/incident commander during major incidents.
Strong incident response track record — leading high-severity investigations, root cause analysis, digital forensics, and post-incident reviews that produced durable improvements.
Solid experience in cloud environments (AWS and/or GCP), with strong understanding of cloud-native threats and controls.
Strong scripting and development skills (Python, Go, Bash, or similar) for building automation, integrations, and internal tooling.
Working knowledge of EDR/XDR, identity, and network detection telemetry, and how to combine signals into high-fidelity detections.
Fluency with security frameworks and standards (NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001) and the judgment to apply them pragmatically.
Background in threat modeling, adversary emulation, and risk-based alert tuning.
Excellent communicator — able to brief executives during a Sev1, write a clear post-mortem, and translate technical risk into business language for non-technical audiences.
Proven track record of leading cross-functional efforts in high-pressure situations and fostering collaboration across InfoSec, IT, and engineering.
Forensics experience, investigating incidents and preserving digital evidence.
Public Trust Clearance
Please note that US citizenship is required to obtain and maintain a government security clearance.
These compensation bands are just the starting point. Once someone joins and proves they’re outlier talent, we adjust quickly to ensure their compensation aligns with their impact.
Our job titles may span more than one career level. Actual pay is determined by skills, qualifications, experience, location, market demand, and other factors. Compensation details listed in this posting reflect the base salary and any potential variable, bonus or sales incentives, and the Company’s estimation of the value of private company stock options, if applicable. The pay range is subject to change, future value of company stock options is not guaranteed, and compensation may be modified in the future. In addition to our total compensation, Sword offers a number of benefits as listed below.
Skills Required
- Public Trust Clearance (must be able to obtain and maintain)
- Bachelor's degree in Computer Science, Cybersecurity, or equivalent experience
- 7+ years experience in Security Operations
- Proven experience scaling a SOC through automation and AI (SOAR, LLM-assisted triage, ML-driven detection)
- Hands-on experience structuring or maturing a SOC (SIEM selection, implementation/migration, detection engineering, runbooks, on-call)
- Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic, or similar)
- Prior experience as technical lead of a SOC or CSIRT (incident commander, mentoring, on-call)
- Strong incident response and digital forensics experience (leading high-severity investigations, post-incident reviews)
- Solid experience in cloud environments (AWS and/or GCP) and cloud-native threat understanding
- Strong scripting and development skills (Python, Go, Bash, or similar) for automation and tooling
- Working knowledge of EDR/XDR, identity, and network telemetry for detection engineering
- Fluency with security frameworks and standards (NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001)
- Background in threat modeling, adversary emulation, and risk-based alert tuning
- Excellent communication skills (executive briefing, post-mortems, cross-functional collaboration)
SWORD Health Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about SWORD Health and has not been reviewed or approved by SWORD Health.
-
Healthcare Strength — Health coverage includes comprehensive medical, dental, and vision, with HSA eligibility and optional accident, hospital, and critical-illness coverage. Life and AD&D insurance are also part of the package.
-
Leave & Time Off Breadth — Time off is structured as discretionary (unlimited) PTO alongside paid company holidays. Remote-first work and flexible hours further support taking time when needed.
-
Wellbeing & Lifestyle Benefits — Free access to the company’s digital therapist is provided for employees and their families. This wellness-oriented perk complements core healthcare coverage.
SWORD Health Insights
What We Do
SWORD Health is the world’s fastest growing virtual musculoskeletal (MSK) care provider, on a mission to free two billion people from chronic and post-surgical pain. The company’s clinical-grade virtual therapy platform pairs expert physical therapists with FDA-listed wearable technology to deliver a personalized treatment plan that is more effective, easier and less expensive than traditional physical therapy. SWORD Health believes in the power of people to recover at home, without resorting to imaging, surgeries or opioids. Since launching in 2015, SWORD Health has worked with insurers, health systems and employers in the U.S, Europe and Australia to make quality physical therapy more accessible to everyone.
