Senior Security Operations Analyst

Xero; City of Melbourne; Hybrid; AUD 150,000 - 190,000; Full time

Benefits offered by this job

Hybrid work model

Flexible hours

Job summary

Xero is seeking a Senior Security Operations Analyst to lead complex investigations within a global Response team. You’ll drive incident response, orchestrate incident command for major events, and guide teams across time zones.

You’ll shape SOC evolution with AI-assisted workflows and play a key role in post-incident learning, detections, and training, while balancing on-call duties and hybrid work arrangements.

Qualifications

• Solid experience in security operations and incident response.
• Track record leading investigations and coordinating teams under pressure.
• Knowledge of attack and defense techniques in cloud and SaaS environments.
• Confidence writing queries in a SIEM or log platform.
• Clear, calm communication and willingness to share knowledge.

Responsibilities

• Lead complex investigations and act as Incident Commander for medium and high impact incidents.
• Coach graduates and analysts through tricky incidents.
• Run post-incident reviews that lead to changes in detections, runbooks and training.
• Lead initiatives with Product Manager and Security Operations Managers to deliver.
• Build and improve automations and AI-assisted workflows with guardrails and sign-off.

Skills

Incident response

Security operations

Incident commander

SIEM queries

Python scripting

Automations / SOAR

AI in security

Cloud security

Communication

Tools

Tines

Job description

The role and its impact

When something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team.

The role and its impact

When something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team. You'll lead our complex investigations and take command of medium and high impact incidents, keeping people calm, decisions moving and stakeholders in the loop. When things settle down, you'll make sure what we learnt changes something, whether that's a detection, a runbook or the way we train. You'll also help us build. Our Analysts improve the queue as well as working it, so part of your time will go on creating automations and AI-assisted workflows that take repetitive work off the team and leave more room for the investigations that need a person.

The Team And How They Connect

Response is a follow-the-sun global team. You'll be in the Southern Hemisphere half, based in New Zealand or Australia, and at the end of your day you'll hand over to colleagues in the UK and North America, who hand back to us the next morning. You'll work business hours in your time zone and take a share of our on-call roster for after-hours incidents. You won't be doing it on your own. You'll join a cohort of Senior Analysts who share the load on complex work and lead our initiatives, with a Lead Analyst alongside for the hardest problems. Our XFLT, a cross-functional leadership team of Security Operations Managers, our Lead Analyst and our Product Manager, sets the direction and clears the way, so there's always someone to think out loud with.

The team is currently working on / Initially, you will focus on

We're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet. You don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right.

You’ll Also

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents
• Be a go-to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff
• Run post incident reviews that lead to real change in detections, runbooks and training
• Lead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered
• Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter
• Work with our Defence engineers on detection and response logic, and test new capabilities in real incidents
• Turn threat intelligence into practical action for Xero
• Give customers and internal teams clear, timely answers to their security concerns

Where And How You Can Work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we're looking for

Incident response comes first for us, so we're looking for:

• Solid experience in security operations, and a real passion for incident response
• A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure
• Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments
• Confidence writing queries in a SIEM or log platform
• Clear, calm communication and a generous approach to sharing what you know

It'd Be Great If You Also Have

• Scripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it.
• Hands-on experience with AI tools in security work, or a clear view of where they help and where they don't
• Intermediate or advanced certifications in incident response, threat hunting or cloud security
• Experience in a distributed team working across time zones

If you're strong on incident response and the builder side is still growing, we'd still love to hear from you.