Senior Security Operations Analyst

Xero; Sydney; Hybrid; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Hybrid work model

Job summary

Xero in Australia is seeking a Senior Security Operations Analyst to lead incident response and shape an AI-assisted SOC. You will manage complex investigations, act as Incident Commander for high-impact events, and drive improvements to detections, runbooks, and training.

Based in New South Wales with a hybrid work model, you’ll build automations and AI workflows to reduce repetitive work while remaining hands-on during critical incidents.

Qualifications

• Strong experience in security operations and incident response.
• Proven track record leading complex investigations.
• Solid knowledge of cloud and SaaS security.
• Ability to write queries in SIEMs and log platforms.

Responsibilities

• Lead complex investigations and Incident Commander for medium and high impact incidents.
• Coach junior analysts and escalation points, guiding through tricky scenarios.
• Run post-incident reviews that drive changes in detections and training.
• Lead initiatives with Product Manager and SOC Managers to deliver outcomes.
• Build automations and AI-assisted workflows with guardrails and approvals.
• Collaborate with Defence engineers on detection and response logic.
• Translate threat intelligence into practical actions for Xero.
• Provide clear, timely security answers to customers and internal teams.

Skills

Security operations

Incident response

Investigation leadership

SIEM queries

Cloud/SaaS security

Clear communication

AI automation

Tools

SIEM platforms

SOAR (Tines)

AI tools in security

Job description

The role and its impact

When something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team.

You'll lead our complex investigations and take command of medium and high impact incidents, keeping people calm, decisions moving and stakeholders in the loop. When things settle down, you'll make sure what we learnt changes something, whether that's a detection, a runbook or the way we train.

You'll also help us build. Our Analysts improve the queue as well as working it, so part of your time will go on creating automations and AI-assisted workflows that take repetitive work off the team and leave more room for the investigations that need a person.

The team and how they connect

Response is a follow-the-sun global team. You'll be in the Southern Hemisphere half, based in New Zealand or Australia, and at the end of your day you'll hand over to colleagues in the UK and North America, who hand back to us the next morning. You'll work business hours in your time zone and take a share of our on-call roster for after-hours incidents.

You won't be doing it on your own. You'll join a cohort of Senior Analysts who share the load on complex work and lead our initiatives, with a Lead Analyst alongside for the hardest problems. Our XFLT, a cross-functional leadership team of Security Operations Managers, our Lead Analyst and our Product Manager, sets the direction and clears the way, so there's always someone to think out loud with.

The team is currently working on / Initially, you will focus on

We're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet.

You don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right.

You’ll also:

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents

• Be a go‑to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff

• Run post incident reviews that lead to real change in detections, runbooks and training

• Lead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered

• Build and improve automations and AI‑assisted workflows, with guardrails and human sign‑off where they matter

• Work with our Defence engineers on detection and response logic, and test new capabilities in real incidents

• Turn threat intelligence into practical action for Xero

• Give customers and internal teams clear, timely answers to their security concerns

Where and how you can work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we're looking for

Incident response comes first for us, so we're looking for:

• Solid experience in security operations, and a real passion for incident response

• A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure

• Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments

• Confidence writing queries in a SIEM or log platform

• Clear, calm communication and a generous approach to sharing what you know

It'd be great if you also have:

• Scripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it.

• Hands‑on experience with AI tools in security work, or a clear view of where they help and where they don't

• Intermediate or advanced certifications in incident response, threat hunting or cloud security

• Experience in a distributed team working across time zones

If you're strong on incident response and the builder side is still growing, we'd still love to hear from you.

You'll do work that matters to millions of small businesses and their advisors, in a team that shares what it knows and backs each other up, with a real say in how an AI‑powered SOC works in practice.