Jobs and Careers

Senior Security Operations Engineer

United States, United Statesfull_timeVerifiedPosted 17 Aug 2026

About the role

At Sword, we’re building AI to heal billions and unlock humanity’s full potential. In doing so, we’re pioneering AI Care, a fundamentally new approach to healthcare built for medical reasoning, safety, and real-time treatment, not generic technology applied after the fact. As both a clinical-centric frontier AI lab and an applied AI platform, Sword is reimagining how care is delivered at scale, removing traditional barriers like appointments, waiting rooms, and stigma so more people can access the care they need - and ultimately get back to lives lived in full.

Since 2020, Sword has expanded across Musculoskeletal, Women’s Health, Cardiometabolic, and Mental Health, and is now moving beyond the session to a fully AI-native, 24/7 care program that brings physical activity, therapeutic exercise, psychotherapy, nutrition, and behavior change into one connected experience. More than 1 million members across three continents have completed over 15 million AI sessions, helping 2,000+ enterprise clients avoid more than $1 billion in unnecessary healthcare costs. Backed by 59 clinical studies, 43 patents, and more than $500 million raised from leading investors including Khosla Ventures, General Catalyst, and Founders Fund, Sword is defining a new standard for healthcare.

Role

As a Senior Security Engineer (Security Operations) at Sword, you will be at the forefront of safeguarding our cloud infrastructure and applications. Your expertise will ensure robust security measures, incident response, and continuous improvement.

Are you looking to join an incredible IT team, passionate about simplifying everyone's work? Look no further, we're hiring! We're a proactive team, constantly staying ahead to ensure everything runs smoothly. As an IT Team we understand the importance of technology in today's workplace and the impact that technical issues can have on productivity and efficiency. Want to join the team? Find out if you've got what it takes!

To get to know more about our Tech Stack, check here.

AI Proficiency at Sword Health

AI fluency is a core expectation at Sword Health. Every candidate is assessed against our three-level framework — be ready to share real examples of how AI is already part of how you work.

Explorer (Level 1) — Uses AI daily to boost personal productivity
Builder (Level 2) — Creates workflows and tools that elevate the whole team
Integrator (Level 3) — Embeds AI into products and processes at scale

Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role.

What you’ll be doing

Design and continuously improve detection and alerting controls, ensuring high fidelity and contextual relevance to reduce noise and enable rapid response.
Build, test, and automate incident response playbooks and runbooks, increasing efficiency and consistency across the incident lifecycle.
Drive prioritization of alerts using a data-driven, scalable triage framework, aligned with business impact and threat context.
Lead in-depth investigations, including root cause analysis and digital forensics, and convert findings into actionable insights to strengthen detection and resilience.
Proactively engage in threat intelligence and threat hunting, identifying new tactics, techniques, and procedures (TTPs), enriching existing controls, and feeding insights into the detection pipeline.
Own incident handling from detection to resolution, collaborating with engineering, IT, and business teams to contain, eradicate, and recover from threats.
Define and maintain operational metrics for incident response, using them to drive continuous improvement in speed, accuracy, and organizational readiness.

What you need to have

Required: Public Trust Clearance - Candidates must be able to obtain and maintain a US public trust clearance.
Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
Solid experience in cloud environments (AWS, GCP, or Azure), with strong understanding of cloud-native threats.
Proficiency in scripting languages (e.g., Python, Bash) for automation and tooling development.
Hands-on experience with SOC tools and platforms, such as SIEM (Splunk, Sentinel, etc.), SOAR, EDR/XDR, and log management.
Strong understanding of incident containment and eradication strategies, with proven ability to coordinate response with technical teams.
Familiarity with security frameworks and standards (NIST 800-61,