Senior Security Operations Analyst

We're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet. You don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right. You'll also:

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents

• Be a go-to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff

• Run post incident reviews that lead to real change in detections, runbooks and training

• Lead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered

• Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter

• Work with our Defence engineers on detection and response logic, and test new capabilities in real incidents

• Turn threat intelligence into practical action for Xero

• Give customers and internal teams clear, timely answers to their security concerns

Incident response comes first for us, so we're looking for:

• Solid experience in security operations, and a real passion for incident response

• A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure

• Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments

• Confidence writing queries in a SIEM or log platform

• Clear, calm communication and a generous approach to sharing what you know

It'd be great if you also have:

• Scripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it.

• Hands-on experience with AI tools in security work, or a clear view of where they help and where they don't

• Intermediate or advanced certifications in incident response, threat hunting or cloud security

• Experience in a distributed team working across time zones

If you're strong on incident response and the builder side is still growing, we'd still love to hear from you. You'll do work that matters to millions of small businesses and their advisors, in a team that shares what it knows and backs each other up, with a real say in how an AI-powered SOC works in practice. Apply even if your experience isn't a perfect match! At Xero, we hire based on your skills, passion, and the unique perspective you can bring to enhance our culture and team.