Senior Security Defense Engineer - Threat Detection

Xero; Wellington; Hybrid; NZD 140,000 - 180,000; Full time

Job summary

Xero is seeking a Senior Engineer in Security Defence to design, build and operate threat-detection capabilities across Security Defence and the wider security team. You’ll work with Security Operations, CX, Product and Engineering to translate threat intel into practical controls while shaping engineering direction and fostering a culture of shared ownership.

You’ll lead complex technical initiatives, implement automated security workflows, and help measure detection coverage and control

Qualifications

• Hands-on experience designing, building and operating production security capabilities.
• Proficiency in Python and applying sound software engineering practices to security.
• Experience with security monitoring, detection, incident response and automation.
• Strong knowledge of cloud security (AWS), logging, identity, networking and security services.
• Familiarity with MITRE ATT&CK and measuring detection coverage.
• Proven ability to lead complex technical initiatives and influence outcomes.

Responsibilities

• Design, build and operate security capabilities to detect and respond to threats.
• Develop automation to reduce manual toil and speed response.
• Measure detection coverage and control effectiveness.
• Collaborate across Security Defence, Security Operations, CX, Product and Engineering.

Skills

Security engineering

Python

Security monitoring

Cloud AWS

Threat intelligence

Incident response

Automation

MITRE ATT&CK

Technical leadership

Risk communication

Tools

SIEM

SOAR

EDR

Job description

Xero is seeking a Senior Engineer in Security Defence to design, build and operate threat-detection capabilities across Security Defence and the wider security team. You’ll work with Security Operations, CX, Product and Engineering to translate threat intel into practical controls while shaping engineering direction and fostering a culture of shared ownership.

You’ll lead complex technical initiatives, implement automated security workflows, and help measure detection coverage and control