Senior Security Operations Analyst

Xero; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

Xero is seeking a Senior Security Operations Analyst to lead incident response and investigations, coordinating medium to high impact incidents and guiding teams through containment, resolution and post-incident learning. You will shape a SOC that leverages AI agents and build automation to reduce repetitive work.

Based in Sydney or Australia time zones, you’ll work hybrid with global on-call duties, collaborating with Product, Security Ops Managers and Defence engineers to turn threat

Qualifications

• Security operations and incident response experience.
• Experience leading complex investigations to resolution.
• Good knowledge of cloud and SaaS security.
• Ability to write queries in a SIEM or log platform.
• Experience across distributed teams and time zones.

Responsibilities

• Lead complex investigations and act as Incident Commander for medium and high impact incidents.
• Coordinate escalation and guide Graduate/Associate/Analyst teams through tricky cases.
• Run post-incident reviews to improve detections, runbooks and training.
• Lead initiatives with Product Manager and Security Ops Managers to deliver outcomes.
• Build and improve automations and AI-assisted workflows with guardrails.
• Collaborate with Defence engineers on detection and response logic and test new capabilities.
• Turn threat intel into practical actions for Xero.
• Provide clear, timely security updates to customers and internal teams.

Skills

Incident response

Investigation leadership

Automation design

AI-assisted workflows

Cloud security

SaaS security

Communication

Tools

SIEM

SOAR (Tines)

Tines

Job description

The role and its impact

When something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team.

You'll lead our complex investigations and take command of medium and high impact incidents, keeping people calm, decisions moving and stakeholders in the loop. When things settle down, you'll make sure what we learnt changes something, whether that's a detection, a runbook or the way we train.

You'll also help us build. Our Analysts improve the queue as well as working it, so part of your time will go on creating automations and AI-assisted workflows that take repetitive work off the team and leave more room for the investigations that need a person.

The Team And How They Connect

Response is a follow-the-sun global team. You'll be in the Southern Hemisphere half, based in New Zealand or Australia, and at the end of your day you'll hand over to colleagues in the UK and North America, who hand back to us the next morning. You'll work business hours in your time zone and take a share of our on-call roster for after-hours incidents.

You won't be doing it on your own. You'll join a cohort of Senior Analysts who share the load on complex work and lead our initiatives, with a Lead Analyst alongside for the hardest problems. Our XFLT, a cross-functional leadership team of Security Operations Managers, our Lead Analyst and our Product Manager, sets the direction and clears the way, so there's always someone to think out loud with.

The team is currently working on / Initially, you will focus on

We're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet.

You don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right.

You’ll Also

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents


• Be a go-to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff


• Run post incident reviews that lead to real change in detections, runbooks and training


• Lead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered


• Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter


• Work with our Defence engineers on detection and response logic, and test new capabilities in real incidents


• Turn threat intelligence into practical action for Xero


• Give customers and internal teams clear, timely answers to their security concerns

Where And How You Can Work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we're looking for

• Solid experience in security operations, and a real passion for incident response


• A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure


• Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments


• Confidence writing queries in a SIEM or log platform


• Clear, calm communication and a generous approach to sharing what you know

It’d Be Great If You Also Have

• Scripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it.


• Hands-on experience with AI tools in security work, or a clear view of where they help and where they don't


• Intermediate or advanced certifications in incident response, threat hunting or cloud security


• Experience in a distributed team working across time zones

If you're strong on incident response and the builder side is still growing, we'd still love to hear from you.

You'll do work that matters to millions of small businesses and their advisors, in a team that shares what it knows and backs each other up, with a real say in how an AI-powered SOC works in practice.