Security Operations Lead (SecOps)

Responsabilidades

• Set the strategy and technical direction for Sword's Security Operations Center, defining the operating model, SIEM and detection architecture, incident response capability, and the roadmap to scale as the company grows
• Drive an AI- and automation-first transformation of security operations by designing SOAR playbooks, agentic and LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR
• Lead the SOC/CSIRT team technically, mentoring detection and response engineers, raising the bar on investigations, running on-call and escalation models, and acting as commander for major incidents
• Own the SIEM end-to-end including architecture, data sources, normalization, retention, cost, and tuning
• Evolve detection-as-code content aligned to MITRE ATT&CK and Sword's threat model
• Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review
• Partner with engineering, IT, legal, and executive stakeholders during critical security events
• Run the threat intelligence and threat hunting programs, converting emerging TTPs into new detections
• Define and report on SOC performance metrics including MTTD, MTTR, coverage, automation rate, and false-positive rate
• Influence security architecture and engineering decisions across the company to ensure detection, response, and recovery are built into new products and infrastructure
• Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises