Senior Security Engineer - Cloud Platform

Xero; City of Melbourne; Hybrid; AUD 140,000 - 190,000; Full time

Job summary

Xero is seeking a Senior Engineer for the Cloud Platform Access team to design and operate identity and access controls at scale across AWS, GCP, and Azure. The role blends hands-on technical leadership with building guardrails that enable teams to ship quickly without privilege creep.

You will mentor engineers, foster psychological safety, and work across security, platform, and product teams to ship secure-by-default controls early in delivery, in a hybrid Melbourne-based environment.

Qualifications

• Experience securing at least one public cloud (AWS, GCP, or Azure) and willingness to learn others.
• Experience designing and maintaining reusable Terraform modules and automation for IAM controls.
• Strong software engineering foundations; automation-first mindset; Python or another scripting language.
• Experience leading design discussions and mentoring engineers.
• Collaborative approach across security, platform, and product teams.
• Interest in thoughtful AI applications to accelerate engineering workflows.

Responsibilities

• Design and operate identity and access controls at scale across AWS, GCP, and Azure.
• Mentor engineers and foster psychological safety on the team.
• Collaborate with security, platform, and product teams to ship secure-by-default controls early in delivery.
• Evolve reusable Terraform modules and internal tooling for standardised secure access patterns.
• Establish KPI baselines and contribute to design reviews, operations, and mentoring within the team.

Skills

Public cloud security

Terraform

Python

IAM

Automation

Mentoring

Tools

Terraform

CI/CD

Job description

The role / impact

As a Senior Engineer in our Cloud Platform Access team, you'll design and operate identity and access controls at scale across AWS, GCP, and Azure. This is high-leverage platform security work where you'll shape secure access as a product rather than simply processing requests. You'll combine hands-on technical leadership with deep expertise to build guardrails that enable teams to ship quickly without creating excessive privilege or long-lived credentials.

You’ll mentor engineers on the team, foster psychological safety, and role-model modern engineering practices. The work sits at the intersection of cloud infrastructure, security, developer experience, and automation - solving genuine problems that unlock productivity across the organisation.

The team / how they connect

The Cloud Platform Access team owns cloud-native identity, access management, and policy enforcement across our public cloud environments. We work collaboratively with platform, security, and product teams to integrate secure-by-default controls early in delivery. The team values psychological safety, thoughtful automation, and engineering excellence - we ship sustainably by removing toil and enabling others to succeed.

The team is currently working on

• Understanding the services, risks, and gaps in our current IAM setup across AWS, GCP, and Azure

• Closing critical identity handover gaps and taking ownership of bounded IAM, Workload Identity Federation, or self-service improvements

• Establishing KPI baselines and contributing to design reviews, operations, and mentoring within the team

• Evolving reusable Terraform modules, policy frameworks, and internal tooling to standardise secure access patterns.

Where and how you can work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we are looking for

• You bring solid experience securing at least one public cloud environment - AWS, GCP, or Azure - with genuine willingness to learn the others. You understand Identity and Infrastructure as Code fundamentals.

• You've designed and maintained reusable Terraform modules and automation that codify IAM controls and policy guardrails at scale.

• Strong software engineering foundations run through your work: you think automation-first, have proficiency in at least one scripting language like Python, and follow modern delivery practices.

• You lead technical design conversations, make sound engineering trade-offs, and aren't afraid to mentor others. You can lift standards, improve reliability, and keep delivery quality high.

• You approach problems collaboratively, building trust across security, platform, and product teams to enable rapid, secure delivery.

• You're curious about thoughtful AI applications and open to exploring how it might accelerate engineering workflows or solve real problems for the team.