Senior Security Engineer - Defence

Xero; Wellington; Hybrid; NZD 140,000 - 180,000; Full time

Job summary

Xero is seeking a Senior Engineer in Security Defence to design, build and operate threat-detection capabilities across Security Defence and the wider security team. You’ll work with Security Operations, CX, Product and Engineering to translate threat intel into practical controls while shaping engineering direction and fostering a culture of shared ownership.

You’ll lead complex technical initiatives, implement automated security workflows, and help measure detection coverage and control

Qualifications

• Hands-on experience designing, building and operating production security capabilities.
• Proficiency in Python and applying sound software engineering practices to security.
• Experience with security monitoring, detection, incident response and automation.
• Strong knowledge of cloud security (AWS), logging, identity, networking and security services.
• Familiarity with MITRE ATT&CK and measuring detection coverage.
• Proven ability to lead complex technical initiatives and influence outcomes.

Responsibilities

• Design, build and operate security capabilities to detect and respond to threats.
• Develop automation to reduce manual toil and speed response.
• Measure detection coverage and control effectiveness.
• Collaborate across Security Defence, Security Operations, CX, Product and Engineering.

Skills

Security engineering

Python

Security monitoring

Cloud AWS

Threat intelligence

Incident response

Automation

MITRE ATT&CK

Technical leadership

Risk communication

Tools

SIEM

SOAR

EDR

Job description

The role / impact

As a Senior Engineer in Security Defence, you'll design, build and operate the capabilities that help Xero detect and respond to security threats. You'll work across Security Operations, Security Response, CX, Product and Engineering, turning threat intelligence and security requirements into reliable, measurable security controls that keep our customers and our business safe.

The role / impact

As a Senior Engineer in Security Defence, you'll design, build and operate the capabilities that help Xero detect and respond to security threats. You'll work across Security Operations, Security Response, CX, Product and Engineering, turning threat intelligence and security requirements into reliable, measurable security controls that keep our customers and our business safe. You'll lead complex technical work, help shape our engineering direction, and build a culture of shared ownership and continuous learning across Security Defence and the wider Security team. It's a role for people who like to Go Bold on hard problems, backed by a team that knows how to Go Fast and figure things out together.

The Team / How They Connect

Security Defence sits at the centre of how Xero detects, investigates and responds to threats. The team covers detection engineering and security automation, working closely with Security Operations, Security Response and Product Engineering to turn intelligence into practical controls. It's a close knit group that shares knowledge openly, challenges assumptions constructively, and backs each other through high pressure moments.

The team is currently working on / Initially, you will focus on

• Detection, monitoring and response workflows across SIEM, SOAR, EDR and cloud security platforms
• Automation that reduces manual toil and speeds up how Security Operations respond to threats
• Ways to measure detection coverage, control effectiveness and operational reliability
• Safe, valuable ways to bring automation and AI into security engineering

Where And How You Can Work

This role can be based in Auckland or Wellington, offering a hybrid working model that balances local team presence with a global scope of work. You will have the flexibility to work from home while connecting with your colleagues in our modern office spaces during designated boost days.

Here are some of the things we're looking for

• You bring hands on experience designing, building and operating production security capabilities or services.
• Your programming or scripting skills, ideally in Python, help you apply sound software engineering practices to security problems.
• Security monitoring, detection, threat intelligence, incident response and automation are all areas you know well, alongside tools such as SIEM, SOAR, EDR or cloud security platforms.
• Working in cloud environments feels natural to you, particularly AWS, along with cloud logging, identity, networking and security services.
• You understand adversary behaviours and frameworks like MITRE ATT&CK, and know how to measure detection coverage and control effectiveness.
• Leading complex technical initiatives and influencing outcomes without relying on formal authority comes naturally, and you can explain technical risk and trade offs with clarity.