RemoteLeaf Logo
Log in Sign up

Security Operations Lead (SecOps)

2 months ago
Portugal
Full-time
Lead
Security Analyst
DevOps and Infrastructure
AWS Bash Elasticsearch GCP Go LLM Machine Learning Python SIEM SOC Splunk
Apply Now
SWORD Health

SWORD Health

SWORD Health provides AI-powered digital physical therapy solutions designed to prevent pain, support recovery, and enhance overall health, while also aiming to transform the rehabilitation industry through innovative technology and clinical oversight.

Health Care Providers & Services
251-1K
Founded 2015
$324M raised
View All Jobs 17

Description

  • Set the strategy and technical direction for the Security Operations Center, including operating model, SIEM and detection architecture, and incident response capability.
  • Drive an AI- and automation-first transformation of security operations through SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection.
  • Lead the SOC/CSIRT team technically by mentoring detection and response engineers, managing on-call and escalation models, and serving as incident commander for major events.
  • Own the SIEM end to end, including architecture, data sources, normalization, retention, cost management, tuning, and detection-as-code content.
  • Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review.
  • Run threat intelligence and threat hunting programs and turn emerging TTPs into new detections and proactive hardening measures.
  • Define, track, and report SOC performance metrics such as MTTD, MTTR, coverage, automation rate, false-positive rate, and on-call health.
  • Influence security architecture and engineering decisions so detection, response, and recovery are built into products, platforms, and infrastructure from the start.
  • Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to improve readiness.

Requirements

  • Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
  • Proven experience scaling a SOC through automation and AI, such as SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection.
  • Hands-on experience building or maturing a SOC, including SIEM selection, implementation or migration, detection engineering, runbook libraries, on-call rotations, and operating metrics.
  • Deep SIEM expertise with tools such as Splunk, Sentinel, Chronicle, Elastic, or similar.
  • Prior experience as the technical lead of a SOC or CSIRT team, owning the full incident response lifecycle and acting as incident commander during major incidents.
  • Strong incident response experience, including high-severity investigations, root cause analysis, digital forensics, and post-incident reviews.
  • Solid experience in cloud environments, especially AWS and/or GCP, with understanding of cloud-native threats and controls.
  • Strong scripting and development skills in Python, Go, Bash, or similar for automation, integrations, and internal tooling.
  • Working knowledge of EDR/XDR, identity, and network detection telemetry and how to combine signals into high-fidelity detections.
  • Fluency with security frameworks and standards such as NIST 800-61, CIS Controls, MITRE ATT&CK, and ISO 27001.
  • Background in threat modeling, adversary emulation, and risk-based alert tuning.
  • Excellent communication skills for executive briefings, post-mortems, and translating technical risk into business language.
  • Proven ability to lead cross-functional efforts in high-pressure situations across InfoSec, IT, and engineering.
  • Forensics experience, including investigating incidents and preserving digital evidence.
  • Valid EU visa and based in Portugal.
  • Preferred AI fluency at Sword Health, with at least Level 1 demonstrated through real examples of using AI in work.

Benefits

  • €50,400 - €79,200 annual compensation, including base pay, variable pay, and equity.
  • Equity shares / stock options as part of total compensation.
  • Health, dental, and vision insurance.
  • Meal allowance.
  • Remote work allowance plus work-from-home flexibility.
  • Flexible working hours.
  • Discretionary vacation.
  • Snacks and beverages.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Qonto

Screening Analyst

Qonto 1K-5K Banks

Qonto is hiring a Screening Analyst to support its Financial Crime team in protecting customers and ensuring compliant operations across European markets.

Serbia Full-time Junior Security Analyst
Swift
37 minutes ago
Toyota Tsusho Systems

Senior Detection & Response Analyst

Toyota Tsusho Systems 51-250 IT Services

Toyota Tsusho Systems US, Inc. is hiring a Senior Detection and Response Analyst to support its Regional Security Operations program by providing 24x7 security monitoring, incident handling, and threat response.

United States Full-time Senior Security Analyst
Active Directory Cybersecurity DNS HTTP Sentinel Splunk
1 hour, 7 minutes ago
Coalfire

Detection and Response Engineer

Coalfire 251-1K Internet Software & Services

Coalfire is hiring a Detection and Response Engineer to support client SIEM monitoring, threat hunting, and purple team activities within its Defensive Services team.

United States Full-time Mid Level Security Analyst
$80k-$134k
Ansible AWS Azure Cybersecurity GCP GitHub GitLab HIPAA SIEM Splunk Terraform
1 hour, 22 minutes ago
Mercury

Risk Investigator - Third Party/ATO Fraud

Mercury 251-1K Banks

Mercury is hiring a Fraud Investigator to lead account takeover investigations within its Account Fraud team, coordinating response and recovery for high-risk customer security incidents.

United States Full-time Senior Security Analyst
$110k-$152k
1 hour, 37 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers