Senior Security Operations: AI-Driven Incident Response

xero; New Zealand; Hybrid; NZD 120,000 - 170,000; Full time

Job summary

Xero is seeking a Senior Security Operations Analyst to lead incident response in a global, AI-enhanced SOC. You’ll own complex investigations, act as Incident Commander for high-impact incidents, and keep stakeholders informed.

As part of the Response team, you’ll build automations and AI-assisted workflows, develop runbooks and improve detections, while guiding junior analysts across time zones. This role offers a hybrid work model in NZ/Australia, with on-call duties and close collaboration

Qualifications

• Extensive experience in security operations and incident response.
• Proven track record leading investigations to resolution.
• Strong judgement in attack/defense with cloud and SaaS environments.
• Ability to write effective SIEM queries.
• Clear, calm communication and coaching skills.

Responsibilities

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents.
• Be a go-to escalation point for Graduate, Associate and Analyst crew, and coach them through tricky stuff.
• Run post incident reviews that lead to real changes in detections, runbooks and training.
• Lead initiatives with Product Manager and Security Operations Managers, turning goals into deliverables.
• Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter.
• Work with Defence engineers on detection and response logic, and test new capabilities in real incidents.
• Turn threat intelligence into practical action for Xero.
• Provide customers and internal teams with clear, timely answers to security concerns.

Skills

Security operations

Incident response leadership

SIEM queries

Communication under pressure

Cloud/SaaS security

Education

IR certifications

Tools

Python scripting

SOAR (Tines)

Job description

Xero is seeking a Senior Security Operations Analyst to lead incident response in a global, AI-enhanced SOC. You’ll own complex investigations, act as Incident Commander for high-impact incidents, and keep stakeholders informed.

As part of the Response team, you’ll build automations and AI-assisted workflows, develop runbooks and improve detections, while guiding junior analysts across time zones. This role offers a hybrid work model in NZ/Australia, with on-call duties and close collaboration