SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Xero is seeking a Senior Security Operations Analyst to lead incident response and security operations within a follow-the-sun global SOC team. You will be based in New Zealand or Australia, working business hours in your time zone while coordinating with colleagues in the UK and North America.
In this role, you will lead complex security investigations and serve as Incident Commander for medium and high-impact incidents, keeping stakeholders informed and decisions moving under pressure. You'll mentor junior analysts (Graduate, Associate, and Analyst level staff), conduct post-incident reviews that drive real improvements to detections and runbooks, and help shape how AI agents integrate into the SOC.
Beyond incident response, you'll build automations and AI-assisted workflows using tools like Tines, working with Defence engineers on detection and response logic. You'll turn threat intelligence into actionable security measures, lead cross-functional initiatives with Product and Security Operations Managers, and provide clear, timely security guidance to customers and internal teams.
Xero is building toward an agentic SOC where AI and automation handle first-pass work while analysts direct them and apply judgment on complex cases. You don't need to be an AI expert, but curiosity and hands-on experience with AI tools in security are valued.
The team operates a flexible hybrid model, with office space in Wellington and the option to work remotely. You'll take a share of the on-call roster for after-hours incidents.
Requirements:
- Solid experience in security operations with a genuine passion for incident response
- Proven track record leading complex investigations and incidents to resolution, including coordinating people and making decisions under pressure
- Sound technical judgment and strong knowledge of attack and defense techniques, particularly in cloud and SaaS environments
- Confidence writing queries in a SIEM or log platform
- Clear, calm communication and willingness to share knowledge generously
Desirable:
- Scripting skills (Python or similar) and experience building automations in a SOAR platform (Tines experience a plus)
- Hands-on experience with AI tools in security work or clear perspective on their applications
- Intermediate or advanced certifications in incident response, threat hunting, or cloud security
- Experience in distributed teams working across time zones
