Remote CTIR Engineer: Incident Response & Threat Hunting

Xplor Education; Auckland; Remote; NZD 120,000 - 180,000; Full time

Benefits offered by this job

Paid Parental Leave

GiveBackDays – 3 days volunteering

Diversity & Inclusion initiatives

Free mental health support

Flexible working arrangements

Job summary

Xplor Education is seeking a hands-on Cyber Threat Intelligence & Response engineer to lead incident response across our platforms. You will triage, investigate, contain and eradicate threats, then recover and improve defenses while coordinating with engineering, IT and leadership.

You should thrive on high-pressure incidents, be comfortable taking ownership from alert to final report, and work remotely from New Zealand with full working rights.

Qualifications

• 3 to 6 years experience in security operations or incident response.
• Experience managing incidents through the full lifecycle.
• Strong triage and root-cause analysis with log correlation.
• Comfort reading logs (HTTP, SMTP, network) and Windows AD.
• Hands-on SIEM experience to investigate, hunt and build detections (MS Sentinel preferred).
• Threat-hunting across network flow and threat intelligence.
• Ability to map attacker activity to Cyber Kill Chain stages.
• Self-starter who works independently and keeps learning.
• Clear, actionable communication to engineers, admins and leadership.
• Familiar with ITIL/ISO27001/PCI DSS processes.

Responsibilities

• Own incidents as part of the CTIR team and drive them to containment.
• Work live incidents and lead when required.
• Lead investigations across systems, logs, endpoints and network data.
• Perform host and network forensics and email analysis to timeline attacker activity.
• Coordinate with engineering, IT and security teams; communicate clearly to stakeholders.
• Hunt for new threats and develop detections and indicators of compromise.
• Build and automate incident response workflows and playbooks.
• Enhance detection coverage using MITRE ATT&CK and tune to reduce noise.
• Feed learnings back to improve detection and response.

Skills

Incident response

Threat hunting

Log analysis

Automation scripting

PowerShell

SIEM

KQL

EDR

SOAR

Tools

Microsoft Sentinel

KQL

EDR

PowerShell

SOAR

Job description

Xplor Education is seeking a hands-on Cyber Threat Intelligence & Response engineer to lead incident response across our platforms. You will triage, investigate, contain and eradicate threats, then recover and improve defenses while coordinating with engineering, IT and leadership.

You should thrive on high-pressure incidents, be comfortable taking ownership from alert to final report, and work remotely from New Zealand with full working rights.