Sword Health

2 months ago

Security Operations Lead (SecOps)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 5 hours agoStatus: Live

Job Summary

Lead Sword Health's Security Operations Center (SOC) strategy and operations, driving an AI- and automation-first transformation of security that scales a lean team across a multi-continent footprint. Own SIEM architecture, detection engineering, and incident response, mentor analysts, and coordinate cross-functional responses during major incidents.

Location: Porto

Workplace: Remote

Employment Type: Full time · Permanent

Job Function: Business Operations

Seniority: Manager level

Key Responsibilities

•Set the strategy and technical direction for Sword’s Security Operations Center—defining operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale as the company grows.
•Drive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR and expand coverage.
•Lead the SOC/CSIRT team technically—mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as incident commander during major incidents.
•Own the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.
•Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, coordinating with engineering, IT, legal, and executives.

Pay and Benefits

Salary: EUR 50,400 - 79,200 annually

Equity and Bonus:Equity

Perks:Health InsuranceMeal AllowanceEquityRemote Work

Key Requirements

•Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
•Proven experience scaling a SOC through automation and AI with measurable impact on MTTR, coverage, or analyst leverage.
•Hands-on experience structuring a SOC, including SIEM selection, implementation or migration, detection engineering, runbooks, and on-call rotations.
•Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic, or similar) and detection-as-code.
•Prior experience as the technical lead of a SOC/CSIRT team, owning the full incident response lifecycle and mentoring analysts.

Experience:CybersecuritySecurity operationsCloud security

Education:Bachelor's

Skills:CommunicationLeadershipProblem-solving

Languages:English

Tech Stack:SplunkSentinelChronicleElasticSOARPythonGoBashAWSGCPLLMEDRXDRMITRE ATT&CK

Company Brief

Sword Health

Develops a digital musculoskeletal care platform combining wearable sensors, AI-driven virtual therapists, and clinical care teams to deliver remote physical therapy and rehabilitation programs for employers, health plans, and patients.

Industry: Digital Therapeutics

Company Size: Enterprise (1,001+ employees)

Growth: Scaleup

Headquarters: Porto, Portugal

Founded: 2015

Website LinkedIn

Loading job details...

Preparing the role view and application actions.

Sword Health

2 months ago

Security Operations Lead (SecOps)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 5 hours agoStatus: Live

Job Summary

Location: Porto

Workplace: Remote

Employment Type: Full time · Permanent

Job Function: Business Operations

Seniority: Manager level

Key Responsibilities

•Set the strategy and technical direction for Sword’s Security Operations Center—defining operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale as the company grows.
•Drive an AI- and automation-first transformation of security operations: design SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR and expand coverage.
•Lead the SOC/CSIRT team technically—mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as incident commander during major incidents.
•Own the SIEM end-to-end (architecture, data sources, normalization, retention, cost, and tuning) and evolve detection-as-code content aligned to MITRE ATT&CK and Sword’s threat model.
•Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, coordinating with engineering, IT, legal, and executives.

Pay and Benefits

Salary: EUR 50,400 - 79,200 annually

Equity and Bonus:Equity

Perks:Health InsuranceMeal AllowanceEquityRemote Work

Key Requirements

•Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
•Proven experience scaling a SOC through automation and AI with measurable impact on MTTR, coverage, or analyst leverage.
•Hands-on experience structuring a SOC, including SIEM selection, implementation or migration, detection engineering, runbooks, and on-call rotations.
•Deep SIEM expertise (Splunk, Sentinel, Chronicle, Elastic, or similar) and detection-as-code.
•Prior experience as the technical lead of a SOC/CSIRT team, owning the full incident response lifecycle and mentoring analysts.

Experience:CybersecuritySecurity operationsCloud security

Education:Bachelor's

Skills:CommunicationLeadershipProblem-solving

Languages:English

Tech Stack:SplunkSentinelChronicleElasticSOARPythonGoBashAWSGCPLLMEDRXDRMITRE ATT&CK

Company Brief

Sword Health

Industry: Digital Therapeutics

Company Size: Enterprise (1,001+ employees)

Growth: Scaleup

Headquarters: Porto, Portugal

Founded: 2015

Website LinkedIn