Senior Security Operations Analyst

About the role

As a Senior Security Operations Analyst at Xero, you will lead complex investigations, act as Incident Commander for medium and high‑impact incidents, and help shape an AI‑assisted SOC.

Key responsibilities

• Lead complex investigations and serve as Incident Commander for medium and high‑impact incidents.
• Coach and support Graduate, Associate and Analyst team members.
• Run post‑incident reviews that drive changes to detections, runbooks and training.
• Build and improve automations and AI‑assisted workflows with appropriate guardrails.
• Collaborate with Defence engineers on detection and response logic and test new capabilities.
• Translate threat intelligence into practical actions for Xero and provide clear answers to security concerns.

Required profile

• Solid experience in security operations with a strong passion for incident response.
• Proven track record of leading complex investigations and making decisions under pressure.
• Excellent communication skills and a collaborative mindset.

Required skills

• Experience writing queries in a SIEM or log platform.
• Scripting skills in Python or similar.
• Hands‑on experience with a SOAR platform (Tines) and building automations.
• Knowledge of cloud and SaaS security concepts.
• Familiarity with AI tools in security work is a plus.