Senior Security Operations Analyst

When something goes wrong in security at Xero, the Response team are first on the scene. The Senior Security Operations Analyst will lead complex investigations, take command of medium and high impact incidents, help build automations and AI-assisted workflows, and help shape what a SOC looks like when AI agents are part of the team. Response is a follow-the-sun global team; the role sits in the Southern Hemisphere half, based in New Zealand or Australia, working business hours in their time zone.

Responsibilities

Lead complex investigations and take command of medium and high impact incidents; Lead complex investigations and step up as Incident Commander for medium and high impact incidents; Be a go-to escalation point for the Graduate, Associate and Analyst team and coach them through the tricky stuff; Run post incident reviews that lead to real change in detections, runbooks and training; Lead initiatives with the Product Manager and Security Operations Managers, turning goals into work that gets delivered; Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter; Work with Defence engineers on detection and response logic, and test new capabilities in real incidents; Turn threat intelligence into practical action for Xero; Give customers and internal teams clear, timely answers to their security concerns; Take a share of the on-call roster for after-hours incidents

Requirements

Solid experience in security operations, and a real passion for incident response; A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure; Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments; Confidence writing queries in a SIEM or log platform; Clear, calm communication and a generous approach to sharing what you know

Nice to have

Scripting skills (Python or similar) and experience building automations in a SOAR platform; Hands-on experience with AI tools in security work, or a clear view of where they help and where they don't; Intermediate or advanced certifications in incident response, threat hunting or cloud security; Experience in a distributed team working across time zones