RemoteLeaf Logo
Log in Sign up

Security Operations Lead (SecOps)

2 months, 3 weeks ago
Portugal
Full-time
Lead
Security Analyst
DevOps and Infrastructure
AWS Bash Elasticsearch GCP Go LLM Machine Learning Python SIEM SOC Splunk
Apply Now
SWORD Health

SWORD Health

SWORD Health provides AI-powered digital physical therapy solutions designed to prevent pain, support recovery, and enhance overall health, while also aiming to transform the rehabilitation industry through innovative technology and clinical oversight.

Health Care Providers & Services
251-1K
Founded 2015
$324M raised
View All Jobs 18

Description

  • Set the strategy and technical direction for the Security Operations Center, including operating model, SIEM and detection architecture, and incident response capability.
  • Drive an AI- and automation-first transformation of security operations through SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection.
  • Lead the SOC/CSIRT team technically by mentoring detection and response engineers, managing on-call and escalation models, and serving as incident commander for major events.
  • Own the SIEM end to end, including architecture, data sources, normalization, retention, cost management, tuning, and detection-as-code content.
  • Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review.
  • Run threat intelligence and threat hunting programs and turn emerging TTPs into new detections and proactive hardening measures.
  • Define, track, and report SOC performance metrics such as MTTD, MTTR, coverage, automation rate, false-positive rate, and on-call health.
  • Influence security architecture and engineering decisions so detection, response, and recovery are built into products, platforms, and infrastructure from the start.
  • Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to improve readiness.

Requirements

  • Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
  • Proven experience scaling a SOC through automation and AI, such as SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection.
  • Hands-on experience building or maturing a SOC, including SIEM selection, implementation or migration, detection engineering, runbook libraries, on-call rotations, and operating metrics.
  • Deep SIEM expertise with tools such as Splunk, Sentinel, Chronicle, Elastic, or similar.
  • Prior experience as the technical lead of a SOC or CSIRT team, owning the full incident response lifecycle and acting as incident commander during major incidents.
  • Strong incident response experience, including high-severity investigations, root cause analysis, digital forensics, and post-incident reviews.
  • Solid experience in cloud environments, especially AWS and/or GCP, with understanding of cloud-native threats and controls.
  • Strong scripting and development skills in Python, Go, Bash, or similar for automation, integrations, and internal tooling.
  • Working knowledge of EDR/XDR, identity, and network detection telemetry and how to combine signals into high-fidelity detections.
  • Fluency with security frameworks and standards such as NIST 800-61, CIS Controls, MITRE ATT&CK, and ISO 27001.
  • Background in threat modeling, adversary emulation, and risk-based alert tuning.
  • Excellent communication skills for executive briefings, post-mortems, and translating technical risk into business language.
  • Proven ability to lead cross-functional efforts in high-pressure situations across InfoSec, IT, and engineering.
  • Forensics experience, including investigating incidents and preserving digital evidence.
  • Valid EU visa and based in Portugal.
  • Preferred AI fluency at Sword Health, with at least Level 1 demonstrated through real examples of using AI in work.

Benefits

  • €50,400 - €79,200 annual compensation, including base pay, variable pay, and equity.
  • Equity shares / stock options as part of total compensation.
  • Health, dental, and vision insurance.
  • Meal allowance.
  • Remote work allowance plus work-from-home flexibility.
  • Flexible working hours.
  • Discretionary vacation.
  • Snacks and beverages.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

RecargaPay

Sr. Fraud Prevention Analyst

RecargaPay 251-1K Capital Markets

RecargaPay is hiring a Risk & Fraud specialist to lead detection mechanisms and fraud strategy for its payment and credit products, using data to guide product decisions and support healthy business growth.

Brazil Full-time Senior Security Analyst
Agile Databricks Looker Machine Learning Power BI Python SQL Tableau
13 hours, 22 minutes ago
Insight Assurance

SOC 2 Staff IT Auditor- Hybrid - Panamá

Insight Assurance 11-50 Diversified Financial Services

Insight Assurance is hiring a hybrid IT/GRC Auditor in Panama City to support audit engagements and IT compliance testing for cybersecurity and compliance frameworks.

Panama Full-time Junior Security Analyst
AWS Azure Cybersecurity GCP HIPAA
13 hours, 22 minutes ago
Alpaca

IT Operations Specialist

Alpaca 51-250 Capital Markets

Alpaca is hiring an IT Operations Specialist to support its globally distributed team and help maintain secure, reliable internal IT operations for a remote brokerage infrastructure company.

United States Canada North America Full-time Junior Security Analyst Technical Support Engineer
Cybersecurity Linux macOS
1 day, 12 hours ago
Aledade

Director of Security Operations, Remote

Aledade 1K-5K Health Care Providers & Services

Aledade is hiring a Director of Security Operations to lead its SOC and security response efforts that protect the company’s assets, data, patients, and reputation.

United States Full-time Executive Operations Manager Security Analyst
HIPAA SIEM
1 day, 12 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers