Lead Incident Commander, AI-Enabled SOC (Remote/Hybrid)

Xero; Wellington; Hybrid; NZD 120,000 - 180,000; Full time

Job summary

Xero is seeking a Senior Security Operations Analyst to lead incident response and help shape what a SOC looks like as AI agents become part of the team. You’ll run complex investigations, command medium and high impact incidents, and ensure learnings drive better detections, runbooks and training.

The role supports a global Response team with a hybrid setup. You’ll build automations and AI-assisted workflows, mentor junior analysts, and collaborate with SOC leaders and Defence engineers to turn

Qualifications

• Solid experience in security operations, and a real passion for incident response.
• Track record leading complex investigations through to resolution under pressure.
• Knowledge of attack and defence techniques in cloud and SaaS environments.
• Confidence writing queries in a SIEM or log platform.
• Clear, calm communication and a generous approach to sharing what you know.

Responsibilities

• Lead complex investigations and act as Incident Commander for medium and high impact incidents.
• Coach junior analysts through tricky issues and escalation paths.
• Run post-incident reviews to improve detections, runbooks and training.
• Drive initiatives with Product Manager and SOC Managers to deliver results.
• Build automations and AI-assisted workflows with guardrails and approvals.
• Collaborate with Defence engineers on detection and response logic and test capabilities.
• Turn threat intelligence into practical actions for Xero.
• Provide clear, timely security updates to customers and internal teams.

Skills

Security operations

Incident response

Incident Commander

Cloud security

SIEM queries

Communication

Tools

Tines

Job description

Xero is seeking a Senior Security Operations Analyst to lead incident response and help shape what a SOC looks like as AI agents become part of the team. You’ll run complex investigations, command medium and high impact incidents, and ensure learnings drive better detections, runbooks and training.

The role supports a global Response team with a hybrid setup. You’ll build automations and AI-assisted workflows, mentor junior analysts, and collaborate with SOC leaders and Defence engineers to turn