Senior Security Engineer - Defence

Xero; City of Melbourne; Hybrid; AUD 140,000 - 200,000; Full time

Job summary

Xero in Melbourne seeks a Senior Engineer in Security Defence to design, build and operate production security capabilities across threat detection, response and automation. You’ll partner with Security Operations, CX, Product and Engineering to translate threat intel into reliable controls.

You’ll lead complex technical work, shape engineering direction and foster a culture of shared ownership, learning and rapid iteration in a flexible hybrid setup.

Qualifications

• Hands-on experience designing, building and operating production security capabilities.
• Strong Python skills and software engineering practices applied to security issues.
• Expertise in security monitoring, detection, threat intelligence, incident response and automation.
• Experience with SIEM, SOAR, EDR and cloud security platforms.
• Experience with AWS and cloud logging, identity, networking and security services.
• Understanding of adversary behaviours and MITRE ATT&CK; ability to measure detection coverage.
• Proven ability to lead complex initiatives and influence outcomes without formal authority.

Responsibilities

• Design, build and operate security detection and response capabilities.
• Collaborate across Security Defence, Security Operations, CX, Product and Engineering.
• Turn threat intelligence into measurable security controls.
• Lead automation efforts to reduce manual toil and improve response times.

Skills

Python programming

Security monitoring

Threat intelligence

Incident response

Automation

Tools

SIEM

SOAR

EDR

AWS

Cloud platforms

Job description

The role / impact

As a Senior Engineer in Security Defence, you'll design, build and operate the capabilities that help Xero detect and respond to security threats. You'll work across Security Operations, Security Response, CX, Product and Engineering, turning threat intelligence and security requirements into reliable, measurable security controls that keep our customers and our business safe.

You'll lead complex technical work, help shape our engineering direction, and build a culture of shared ownership and continuous learning across Security Defence and the wider Security team. It's a role for people who like to Go Bold on hard problems, backed by a team that knows how to Go Fast and figure things out together.

The team / how they connect

Security Defence sits at the centre of how Xero detects, investigates and responds to threats. The team covers detection engineering and security automation, working closely with Security Operations, Security Response and Product Engineering to turn intelligence into practical controls. It's a close knit group that shares knowledge openly, challenges assumptions constructively, and backs each other through high pressure moments.

The team is currently working on / Initially, you will focus on

• Detection, monitoring and response workflows across SIEM, SOAR, EDR and cloud security platforms
• Automation that reduces manual toil and speeds up how Security Operations respond to threats
• Ways to measure detection coverage, control effectiveness and operational reliability
• Safe, valuable ways to bring automation and AI into security engineering

Where and how you can work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we’re looking for

• You bring hands on experience designing, building and operating production security capabilities or services.
• Your programming or scripting skills, ideally in Python, help you apply sound software engineering practices to security problems.
• Security monitoring, detection, threat intelligence, incident response and automation are all areas you know well, alongside tools such as SIEM, SOAR, EDR or cloud security platforms.
• Working in cloud environments feels natural to you, particularly AWS, along with cloud logging, identity, networking and security services.
• You understand adversary behaviours and frameworks like MITRE ATT&CK, and know how to measure detection coverage and control effectiveness.
• Leading complex technical initiatives and influencing outcomes without relying on formal authority comes naturally, and you can explain technical risk and trade offs with clarity.