Senior Security Operations Engineer

• As a Senior Security Engineer (Security Operations) at Sword, you will be at the forefront of safeguarding our cloud infrastructure, and applications. Your expertise will ensure robust security measures, incident response, and continuous improvement
• Design and continuously improve detection and alerting controls, ensuring high fidelity and contextual relevance to reduce noise and enable rapid response
• Build, test, and automate incident response playbooks and runbooks, increasing efficiency and consistency across the incident lifecycle
• Drive prioritization of alerts using a data-driven, scalable triage framework, aligned with business impact and threat context
• Lead in-depth investigations, including root cause analysis and digital forensics, and convert findings into actionable insights to strengthen detection and resilience
• Proactively engage in threat intelligence and threat hunting, identifying new tactics, techniques, and procedures (TTPs), enriching existing controls, and feeding insights into the detection pipeline
• Own incident handling from detection to resolution, collaborating with engineering, IT, and business teams to contain, eradicate, and recover from threats
• Define and maintain operational metrics for incident response, using them to drive continuous improvement in speed, accuracy, and organizational readiness
• Leverage AI to automate and optimize security operations workflows, including alert triage, enrichment, and incident classification
• Design and maintain AI-assisted runbooks, ensuring consistency, auditability, and human-in-the-loop validation for critical decisions
• Identify opportunities to improve SOC efficiency through AI-driven automation, while maintaining strong controls and avoiding over-reliance on unverified outputs
• Integrate security tooling with AI platforms and APIs to streamline investigation, response, and reporting processes
• Enhance vulnerability management and incident response workflows through intelligent prioritization, correlation, and contextualization of findings
• Continuously evaluate the accuracy, reliability, and security implications of AI-assisted decisions in operational environments

Benefits

• A stimulating, fast-paced environment with lots of room for creativity
• A bright future at a promising high-tech startup company
• The opportunity to work with a talented team and to add real value to an innovative solution with the potential to change the future of healthcare
• A stimulating environment with room for creativity
• A flexible environment where you can control your hours (remotely) with unlimited vacation
• Access to our health and well-being program (digital therapist sessions)
• Remote or Hybrid work policy
• Career development and growth- Ability to foster collaboration across InfoSec, IT, and engineering teams
• Forensics experience, investigating incidents and preserving digital evidence
• Ability to consume and synthesize intelligence about actors, techniques or situations to identify emerging risk scenarios
• Proficiency in scripting languages (e.g., Python, Bash) for automation and tooling development
• Hands-on experience with SOC tools and platforms, such as SIEM (Splunk, Sentinel, etc.), SOAR, EDR/XDR, and log management
• Proven track record of leading cross-functional efforts in high-pressure situations
• Background in threat modeling, adversary emulation, and risk-based alert tuning
• Excellent analytical, critical thinking, and problem-solving skills
• Strong understanding of incident containment and eradication strategies, with proven ability to coordinate response with technical teams
• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience
• Strong communicator with the ability to explain security risks and actions to both technical and non-technical audiences
• Proficiency in process formulation and improvement
• Familiarity with security frameworks and standards (NIST 800-61, CIS Controls, MITRE ATT&CK, ISO 27001)
• Solid experience in cloud environments (AWS, GCP, or Azure), with strong understanding of cloud-native threats
• Required: Public Trust Clearance - Candidates must be able to obtain and maintain a US public trust clearance