← All roles

Senior Security Operations Engineer

Tandem Health· Product & Engineering
Apply on company site
StockholmFull-timePosted 1mo ago

About the role

Senior individual contributor role leading Tandem Health's security operations programme, spanning telemetry, detection engineering, incident response, and collaboration with MDR. Hands-on, with influence over tooling, processes, and team growth in a healthcare-focused, regulated environment.

Responsibilities

  • Own a risk-prioritised plan for bringing data sources into our security information and event management (SIEM) platform.
  • Make telemetry dependable. Build checks that show when important data is missing, delayed or incomplete.
  • Develop a repeatable detection lifecycle that covers creation, testing, tuning, ownership and retirement.
  • Lead the technical response to security incidents. Establish scope, urgency and likely impact, then guide containment and remediation.
  • Make containment decisions with the Head of Security and relevant system owners. Take direct action when an approved playbook and delegated authority allow it.
  • Coordinate security incidents from detection to closure. Keep playbooks, decision records, escalation paths and after-action reviews useful and current.
  • Run practical security incident training and exercises. Help colleagues understand their roles and respond with confidence under pressure.
  • Give our medical device regulation compliance and legal teams the technical evidence they need to assess potential privacy incidents.
  • Build an effective operating model with our MDR provider and other security partners. Make ownership and hand-offs clear.
  • Measure what matters, including telemetry coverage, detection quality, response time, hand-off quality and completed follow-up actions.
  • Find practical uses for AI in security operations. Put clear data boundaries, evaluation, human approval, audit and fallback controls around those workflows.
  • Document the systems and decisions you build so future team members can contribute quickly.

Qualifications

  • Coordinate security incidents across technical and non-technical teams.
  • Judge when to gather more evidence, when to contain and when to escalate.
  • Work with telemetry from identity, endpoint, cloud, network and application systems.
  • Build and operate SIEM integrations, detections and telemetry health checks.
  • Use code or automation to remove repetitive work and make response more reliable.
  • Distinguish expected behavior, control failures and credible malicious activity.
  • Write clear playbooks, investigation notes and after-action reviews.
  • Explain technical risk to engineers, leaders and colleagues outside security.
  • Bring structure to an incomplete process without waiting for perfect conditions.
  • Work collaboratively and stay calm when the answer is not yet clear.

Skills

Required:Security incident managementTelemetry and SIEMDetection engineeringAutomation and codingCommunication

Benefits

  • Competitive salary and company stock options.
  • Additional compensation for on-call rotations
  • 30 days of paid holiday each year.
  • 5,000 SEK wellness allowance, plus 6,000 SEK each year for other health-related initiatives.
  • Parental leave top-up for new parents.
  • Private medical insurance.
  • Mental health support through Mindler.
  • Pension programme.
  • Regular social and team activities, including off-sites and seasonal events.
Last updated Sep 9, 2026. Interested? Apply on the company site.

About Tandem Health

Your AI assistant for every step of care

Tandem captures consultations and prepares structured clinical notes, documents, and codes for review. Designed for safe, compliant use across clinical care.

Clinical Decision SupportCompanyCustomer storiesEuropeHealth techProductRegulated clinical AIResources
Company profileWebsite

More open roles at Tandem Health