Senior Security Operations Lead - AI-Driven SOC

Xero; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

Xero is seeking a Senior Security Operations Analyst to lead incident response and investigations, coordinating medium to high impact incidents and guiding teams through containment, resolution and post-incident learning. You will shape a SOC that leverages AI agents and build automation to reduce repetitive work.

Based in Sydney or Australia time zones, you’ll work hybrid with global on-call duties, collaborating with Product, Security Ops Managers and Defence engineers to turn threat

Qualifications

• Security operations and incident response experience.
• Experience leading complex investigations to resolution.
• Good knowledge of cloud and SaaS security.
• Ability to write queries in a SIEM or log platform.
• Experience across distributed teams and time zones.

Responsibilities

• Lead complex investigations and act as Incident Commander for medium and high impact incidents.
• Coordinate escalation and guide Graduate/Associate/Analyst teams through tricky cases.
• Run post-incident reviews to improve detections, runbooks and training.
• Lead initiatives with Product Manager and Security Ops Managers to deliver outcomes.
• Build and improve automations and AI-assisted workflows with guardrails.
• Collaborate with Defence engineers on detection and response logic and test new capabilities.
• Turn threat intel into practical actions for Xero.
• Provide clear, timely security updates to customers and internal teams.

Skills

Incident response

Investigation leadership

Automation design

AI-assisted workflows

Cloud security

SaaS security

Communication

Tools

SIEM

SOAR (Tines)

Tines

Job description

Xero is seeking a Senior Security Operations Analyst to lead incident response and investigations, coordinating medium to high impact incidents and guiding teams through containment, resolution and post-incident learning. You will shape a SOC that leverages AI agents and build automation to reduce repetitive work.

Based in Sydney or Australia time zones, you’ll work hybrid with global on-call duties, collaborating with Product, Security Ops Managers and Defence engineers to turn threat