[![Image](https://upload.wikimedia.org/wikipedia/commons/8/82/Telegram_logo.svg) Fresh remote jobs, sorted by category — join Jobicy on Telegram  › Fresh remote jobs on Telegram  ›](https://t.me/JobicyJobs) [All remote jobs](https://jobicy.com/jobs.md)Open role[![SWORD Health logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5dda1790-221.jpg)](https://jobicy.com/company/sword-health.md)Remote opportunity at[SWORD Health](https://jobicy.com/company/sword-health.md)

# Security Operations Lead (SecOps)

Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.

[Apply for this job](#job-application)[View company](https://jobicy.com/company/sword-health.md)Share31 Aug 2026Published24Listing views1Application actions30 Sep 2026Apply before  Opportunity details

## About this role.

AI SummarySword Health is seeking a senior, hands-on Security Operations Lead to set the technical direction and operating model for its SOC/CSIRT function. The role owns SIEM architecture, detection engineering, incident response, threat hunting, and SOC performance metrics across a multi-continent healthcare technology environment. It requires extensive experience scaling security operations through SOAR, AI-assisted workflows, automation, cloud security, and detection-as-code. The lead will mentor security engineers, command high-severity incidents, and communicate technical risk clearly to executives and cross-functional partners. Candidates must be eligible to obtain and maintain a US Public Trust clearance, which requires US citizenship.

## Role DNA

A quick view of the complexity, pace, ownership and collaboration implied by the job description.

### Job Complexity

5/5EasyHard

### Pace & Pressure

5/5RelaxedFast-paced

### Autonomy Level

5/5GuidedFull ownership

### Communication Load

5/5IndependentCollaborative

AI insightThis is a high-impact security leadership role requiring deep technical ownership across SOC architecture, incident response, cloud telemetry, forensics, automation, and AI-enabled operations. The combination of hands-on execution, team leadership, executive incident communication, and clearance requirements makes it highly demanding.

## Salary analysis

Estimated compensation compared with the broader US market for similar roles.

Estimated job medianMarket rate$172,258US market range$150k–$225k0$248k

AI insightThe disclosed yearly total compensation range is USD 133,978 to USD 210,537, producing a midpoint of USD 172,257.50. This is broadly competitive for a US-based senior Security Operations Lead with SOC/CSIRT leadership, SIEM architecture, cloud incident response, and automation expertise; a typical US market range is estimated at USD 150,000 to USD 225,000, depending on location, security-clearance eligibility, and scope of leadership responsibility.

## Core skills

Skills and capabilities most closely associated with this opportunity.

[Security Operations](https://jobicy.com/jobs?search_keywords=Security%20Operations.md)[SOC Leadership](https://jobicy.com/jobs?search_keywords=SOC%20Leadership.md)[Incident Response](https://jobicy.com/jobs?search_keywords=Incident%20Response.md)[SIEM Architecture](https://jobicy.com/jobs?search_keywords=SIEM%20Architecture.md)[Detection Engineering](https://jobicy.com/jobs?search_keywords=Detection%20Engineering.md)[Threat Hunting](https://jobicy.com/jobs?search_keywords=Threat%20Hunting.md)[SOAR Automation](https://jobicy.com/jobs?search_keywords=SOAR%20Automation.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[Digital Forensics](https://jobicy.com/jobs?search_keywords=Digital%20Forensics.md)[MITRE ATT&CK](https://jobicy.com/jobs?search_keywords=MITRE%20ATTCK.md)

Sample interview questionsHow would you design and mature Sword's SIEM and detection-engineering program during your first six months?I would begin with a telemetry and coverage assessment mapped to Sword's critical assets, threat model, and MITRE ATT&CK. I would prioritize high-value identity, cloud, endpoint, application, and network signals; establish data-quality standards; and build detections as code with testing, version control, ownership, and measurable fidelity. I would then create a roadmap balancing coverage, ingestion cost, automation opportunities, and operational readiness.

Describe how you have used automation or AI to improve a SOC's performance.

A strong answer should explain a specific workflow, such as automated enrichment and case triage, entity correlation, phishing analysis, or cloud-alert containment. It should quantify impact through metrics such as reduced MTTR, lower false-positive volume, increased investigation throughput, or better detection coverage. It should also address safeguards, including human approval for disruptive actions, prompt and data controls, and ongoing quality measurement.

How would you lead a Sev1 security incident involving a potential compromise of sensitive healthcare data?

I would activate the incident process, establish an incident command structure, preserve evidence, and rapidly scope affected identities, systems, data, and attacker activity. In parallel, I would coordinate containment with engineering and IT, keep legal and executive stakeholders informed through concise updates, and maintain a detailed decision log. After recovery, I would lead root-cause analysis and translate lessons into durable control, detection, runbook, and architecture improvements.

What metrics would you use to assess SOC effectiveness, and how would you avoid optimizing for misleading metrics?

I would track MTTD, MTTR, alert fidelity, detection coverage against prioritized threats, automation rate, investigation backlog, escalation quality, on-call health, and time from new threat intelligence to operational detection. Metrics should be segmented by severity and data source rather than averaged in ways that hide risk. I would pair operational measures with periodic incident simulations and coverage reviews to validate that efficiency gains do not reduce meaningful detection capability.

How do you communicate technical security risk to executives and nontechnical partners during a critical event?

I communicate the business impact first: what happened, what is known and unknown, affected services or data, immediate containment actions, decisions needed, and the next update time. I avoid unnecessary technical detail while remaining transparent about confidence and risk. Technical teams receive deeper indicators, hypotheses, and action owners, while executives receive clear options, tradeoffs, and implications for customers, operations, and compliance.

At Sword, we’re building AI to heal billions and unlock humanity’s full potential. In doing so, we’re pioneering AI Care, a fundamentally new approach to healthcare built for medical reasoning, safety, and real-time treatment, not generic technology applied after the fact. As both a clinical-centric frontier AI lab and an applied AI platform, Sword is reimagining how care is delivered at scale, removing traditional barriers like appointments, waiting rooms, and stigma so more people can access the care they need – and ultimately get back to lives lived in full.

Since 2020, Sword has expanded across Musculoskeletal, Women’s Health, Cardiometabolic, and Mental Health, and is now moving beyond the session to a fully AI-native, 24/7 care program that brings physical activity, therapeutic exercise, psychotherapy, nutrition, and behavior change into one connected experience. More than 1 million members across three continents have completed over 15 million AI sessions, helping 2,000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 59 clinical studies, 43 patents, and more than $500 million raised from leading investors including Khosla Ventures, General Catalyst, and Founders Fund, Sword is defining a new standard for healthcare.

Role

As Security Operations Lead, you’ll lead our SecOps squad and own how Sword detects, investigates, and responds to threats. You’ll help structure how this function operates — setting the direction on SIEM architecture, detection engineering, and incident response — and use automation and AI to scale a focused team across a fast-growing, multi-continent footprint. You’ll be a core voice in our security strategy, and the systems, processes, and culture you build will set the bar for how Sword protects 700,000+ members.

To get to know more about our Tech Stack, check [here](https://stackshare.io/sword-health/sword-health).

AI Proficiency at Sword Health

AI fluency is a core expectation at Sword Health. Every candidate is assessed against our three-level framework — be ready to share real examples of how AI is already part of how you work.

*

Explorer (Level 1) — Uses AI daily to boost personal productivity

*

Builder (Level 2) — Creates workflows and tools that elevate the whole team

*

Integrator (Level 3) — Embeds AI into products and processes at scale

Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role.

### What you’ll be doing

* Serve as the hands-on technical lead for Sword’s Security Operations Center. Setting the technical direction — architecting the SIEM, engineering detection logic, executing incident response, and building the technical roadmap to scale our defenses as the company grows.
*

Own the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.

*

Lead the SOC/CSIRT team technically — mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as commander for major incidents.

*

Set the strategy and technical direction for Sword’s Security Operations Center — defining the operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale them as the company grows.

*

Drive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR, expand coverage, and let a lean team operate at enterprise scale.

*

Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, partnering with engineering, IT, legal, and executive stakeholders during critical events.

*

Run the threat intelligence and threat hunting programs, converting emerging TTPs into new detections, proactive hardening, and informed risk decisions.

*

Define and report on SOC performance — MTTD, MTTR, coverage, automation rate, false-positive rate, on-call health — and use those metrics to drive measurable, continuous improvement.

*

Influence security architecture and engineering decisions across the company, ensuring detection, response, and recovery are built into new products, platforms, and infrastructure from day one.

*

Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to ensure organizational readiness.

### What you need to have

* Required: Public Trust Clearance – Candidates must be able to obtain and maintain a US public trust clearance.
*

Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.

* 7+ years experience in Security Operations
*

Proven experience scaling a SOC through automation and AI — SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection — with measurable impact on MTTR, coverage, or analyst leverage.

*

Hands-on experience structuring a SOC, either building one from the ground up or maturing one through significant transformation — SIEM selection, implementation or migration, detection engineering practice, runbook libraries, on-call rotations, and operating metrics.

*

Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic, or similar) — ingestion architecture, detection-as-code, query optimization, and coverage-versus-cost tradeoffs.

*

Prior experience as the technical lead of a SOC or CSIRT team — owning the full incident response lifecycle, mentoring analysts and engineers, and acting as on-call/incident commander during major incidents.

*

Strong incident response track record — leading high-severity investigations, root cause analysis, digital forensics, and post-incident reviews that produced durable improvements.

*

Solid experience in cloud environments (AWS and/or GCP), with strong understanding of cloud-native threats and controls.

*

Strong scripting and development skills (Python, Go, Bash, or similar) for building automation, integrations, and internal tooling.

*

Working knowledge of EDR/XDR, identity, and network detection telemetry, and how to combine signals into high-fidelity detections.

*

Fluency with security frameworks and standards (NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001) and the judgment to apply them pragmatically.

*

Background in threat modeling, adversary emulation, and risk-based alert tuning.

*

Excellent communicator — able to brief executives during a Sev1, write a clear post-mortem, and translate technical risk into business language for non-technical audiences.

*

Proven track record of leading cross-functional efforts in high-pressure situations and fostering collaboration across InfoSec, IT, and engineering.

*

Forensics experience, investigating incidents and preserving digital evidence.

### Public Trust Clearance

Candidates must be able to obtain and maintain a US public trust clearance.
Please note that US citizenship is required to obtain and maintain a government security clearance.

### Compensation

### Additional Information

*This range includes base, variable and equity.

These compensation bands are just the starting point. Once someone joins and proves they’re outlier talent, we adjust quickly to ensure their compensation aligns with their impact.

Our job titles may span more than one career level. Actual pay is determined by skills, qualifications, experience, location, market demand, and other factors. Compensation details listed in this posting reflect the base salary and any potential variable, bonus or sales incentives, and the Company’s estimation of the value of private company stock options, if applicable. The pay range is subject to change, future value of company stock options is not guaranteed, and compensation may be modified in the future. In addition to our total compensation, Sword offers a number of benefits as listed below.

US – Sword Benefits & Perks:

• Comprehensive health, dental and vision insurance*

• Life and AD&D Insurance*

• Financial advisory services*

• Supplemental Insurance Benefits (Accident, Hospital and Critical Illness)*

• Health Savings Account*

• Equity shares*

• Discretionary PTO plan*

• Parental leave*

• 401(k)

• Flexible working hours

• Remote-first company

• Paid company holidays

• Free digital therapist for you and your family

*Eligibility: Full-time employees regularly working 25+ hours per week

Note: Applicants must have a legal right to work in the United States, and immigration or work visa sponsorship will not be provided.

SWORD Health, which includes SWORD Health, Inc. and Sword Health Professionals (consisting of Sword Health Care Providers, P.A., SWORD Health Care Providers of NJ, P.C., SWORD Health Care Physical Therapy Providers of CA, P.C.*) complies with applicable Federal and State civil rights laws and does not discriminate on the basis of Age, Ancestry, Color, Citizenship, Gender, Gender expression, Gender identity, Gender information, Marital status, Medical condition, National origin, Physical or mental disability, Pregnancy, Race, Religion, Caste, Sexual orientation, and Veteran status.

Show more

[Apply now >](https://jobicy.com/jobs/152249-security-operations-lead-secops.md)

*

![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+)

### Upload your resume now

To unlock remote work opportunities and be discovered by global employers.

This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.

Next step

## Apply now.

Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.

Keep exploring

## Related remote jobs.

Matched by job category10 related opportunities[Cybersecurity](https://jobicy.com/categories/cybersecurity.md) [Browse all jobs](https://jobicy.com/jobs.md)
*
![Zscaler logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b3234031-221.png)
Zscaler  Aug 31

### [Director, Specialist Sales Engineering – Data Security](https://jobicy.com/jobs/152257-director-specialist-sales-engineering-data-security.md)

About Zscaler Zscaler accelerates digital transformation to ensure our customers can be more agile, efficient, resilient, and secure. As an AI-forward enterprise, we are constantly pushing the envelope, leveraging the…

*
![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg)
Reddit  Aug 31

### [Staff Product Security Engineer](https://jobicy.com/jobs/152256-staff-product-security-engineer.md)

Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit…

*
![SWORD Health logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5dda1790-221.jpg)
SWORD Health  Aug 31

### [Senior Security Operations Engineer](https://jobicy.com/jobs/152254-senior-security-operations-engineer-2.md)

At Sword, we’re building AI to heal billions and unlock humanity’s full potential. In doing so, we’re pioneering AI Care, a fundamentally new approach to healthcare built for medical reasoning,…

*
![Apollo.io logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/f3c639242c4d1f4cb9c0730ac3842a72.jpeg)
Apollo.io  Aug 31

### [Senior Application Security Engineer](https://jobicy.com/jobs/152253-senior-application-security-engineer-2.md)

Apollo.io is the leading go-to-market solution for revenue teams, trusted by over 500,000 companies and millions of users globally, from rapidly growing startups to some of the world’s largest enterprises….

*
![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg)
Reddit  Aug 31

### [Senior Security Engineer, AI Security](https://jobicy.com/jobs/152252-senior-security-engineer-ai-security.md)

Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit…

*
![Maven Clinic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/07/c4b2d5ecf34b-221.webp)
Maven Clinic  Aug 31

### [Staff Software Engineer – Product Security](https://jobicy.com/jobs/152250-staff-software-engineer-product-security.md)

Maven Clinic is the world’s largest virtual clinic for women and families on a mission to make healthcare work for all of us. Through Maven Enterprise, the company partners with…

*
![Apollo.io logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/f3c639242c4d1f4cb9c0730ac3842a72.jpeg)
Apollo.io  Aug 31

### [Engineering Manager, Security Detection & Response](https://jobicy.com/jobs/152248-engineering-manager-security-detection-response.md)

Apollo.io is the leading go-to-market solution for revenue teams, trusted by over 500,000 companies and millions of users globally, from rapidly growing startups to some of the world’s largest enterprises….

*
![YipitData logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e1bee9df-221.jpg)
YipitData  Aug 31

### [Product Security Engineer](https://jobicy.com/jobs/152175-product-security-engineer.md)

About Us: YipitData is the leading market research and analytics firm for the disruptive economy and most recently raised $475M from The Carlyle Group at a valuation of over $1B….

*
![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png)
TRM Labs  Aug 31

### [Senior Cyber Threat Intelligence Analyst](https://jobicy.com/jobs/152158-senior-cyber-threat-intelligence-analyst.md)

Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build…

*
![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png)
TRM Labs  Aug 31

### [Staff Cyber Threat Intelligence Analyst](https://jobicy.com/jobs/152155-staff-cyber-threat-intelligence-analyst.md)

Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build…