Role overview

Xero is seeking a Senior Security Operations Analyst to join its Response team, which handles incident response and security investigations. You will lead complex security incidents, mentor junior analysts, and contribute to building automation and AI-assisted workflows that shape how the Security Operations Centre functions as AI agents become integrated into the team.

Key responsibilities

Lead complex investigations and serve as Incident Commander for medium and high-impact security incidents.
Provide escalation support and coaching to Graduate, Associate and Analyst-level team members on challenging investigations.
Conduct post-incident reviews that drive measurable improvements to detection logic, runbooks and team training.
Build and enhance automations and AI-assisted workflows, ensuring appropriate guardrails and human approval processes are in place.
Collaborate with Defence engineers on detection and response capabilities, and test new security features in live incidents.
Translate threat intelligence into actionable security measures specific to Xero’s environment.
Provide clear and timely security guidance to customers and internal stakeholders.

Requirements

Demonstrated experience in security operations with a strong focus on and passion for incident response work.
Proven track record leading complex investigations and incidents to resolution, including coordinating teams and making decisions under pressure.
Sound technical judgment and solid knowledge of attack and defence techniques, particularly in cloud and SaaS environments.
Proficiency writing queries in a SIEM or log analysis platform.
Strong, clear communication skills and a collaborative approach to knowledge sharing.
Experience with Python or similar scripting languages and familiarity with SOAR platform automation (Tines experience is valuable but not required).
Intermediate or advanced certifications in incident response, threat hunting or cloud security are advantageous.

What makes this role worth considering

You will join a distributed follow-the-sun global team based in the Southern Hemisphere, working business hours in your local time zone while handing over to colleagues across the UK and North America. The role offers the opportunity to shape how artificial intelligence and automation are thoughtfully integrated into security operations, with a focus on ensuring people make the critical decisions while automation handles repetitive work. Xero supports flexible and hybrid working arrangements to help you balance professional and personal commitments.