{"id":1990883,"url":"https://alion.io/job/xero-senior-security-operations-analyst","title":"Senior Security Operations Analyst","company":{"id":5206,"name":"Xero","domain":"xero.com","url":"https://alion.io/company/xero","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":87,"open_postings":20,"ghost_share":0,"stale_share":0.45,"repost_share":0.1,"time_to_fill_p50_days":31,"computed_at":"2026-10-10T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Wellington, New Zealand","Auckland, New Zealand","Sydney, Australia","Melbourne, Australia"],"countries":["NZ","AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":80000,"max_usd":187000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1824},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Commander.js","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Tines","optional":false},{"name":"Xero","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-10-07T05:43:02Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-12T02:36:06Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"The role and its impact\nWhen something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team.\nYou'll lead our complex investigations and take command of medium and high impact incidents, keeping people calm, decisions moving and stakeholders in the loop. When things settle down, you'll make sure what we learnt changes something, whether that's a detection, a runbook or the way we train.\nYou'll also help us build. Our Analysts improve the queue as well as working it, so part of your time will go on creating automations and AI-assisted workflows that take repetitive work off the team and leave more room for the investigations that need a person.\nThe team and how they connect\nResponse is a follow-the-sun global team. You'll be in the Southern Hemisphere half, based in New Zealand or Australia, and at the end of your day you'll hand over to colleagues in the UK and North America, who hand back to us the next morning. You'll work business hours in your time zone and take a share of our on-call roster for after-hours incidents.\nYou won't be doing it on your own. You'll join a cohort of Senior Analysts who share the load on complex work and lead our initiatives, with a Lead Analyst alongside for the hardest problems. Our XFLT, a cross-functional leadership team of Security Operations Managers, our Lead Analyst and our Product Manager, sets the direction and clears the way, so there's always someone to think out loud with.\nThe team is currently working on / Initially, you will focus on\nWe're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet.\nYou don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right.\nYou’ll also:\nLead complex investigations and step up as Incident Commander for medium and high impact incidents\n\nBe a go-to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff\n\nRun post incident reviews that lead to real change in detections, runbooks and training\n\nLead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered\n\nBuild and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter\n\nWork with our Defence engineers on detection and response logic, and test new capabilities in real incidents\n\nTurn threat intelligence into practical action for Xero\n\nGive customers and internal teams clear, timely answers to their security concerns\n\nWhere and how you can work\nWe support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.\nHere are some of the things we're looking for\nIncident response comes first for us, so we're looking for:\nSolid experience in security operations, and a real passion for incident response\n\nA track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure\n\nSound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments\n\nConfidence writing queries in a SIEM or log platform\n\nClear, calm communication and a generous approach to sharing what you know\n\nIt'd be great if you also have:\nScripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it.\n\nHands-on experience with AI tools in security work, or a clear view of where they help and where they don't\n\nIntermediate or advanced certifications in incident response, threat hunting or cloud security\n\nExperience in a distributed team working across time zones\n\nIf you're strong on incident response and the builder side is still growing, we'd still love to hear from you.\nYou'll do work that matters to millions of small businesses and their advisors, in a team that shares what it knows and backs each other up, with a real say in how an AI-powered SOC works in practice.\nApply even if your experience isn't a perfect match! At Xero, we hire based on your skills, passion, and the unique perspective you can bring to enhance our culture and team.","description_format":"text","description_chars":4873,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule"],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"},{"name":"New Zealand","iso":"NZ","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Software","HR & Payroll Software","Accounting & Tax Software","Accounting & Bookkeeping Services"],"lifecycle":[{"event":"open","at":"2026-10-07T06:10:29Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":31,"reasons":["conf:0","velocity","win:early","comp:brand"],"computed_at":"2026-10-10T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/xero-senior-security-operations-analyst","json_url":"https://alion.io/job/xero-senior-security-operations-analyst.json","meta":{"generated_at":"2026-10-12T04:34:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7137,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5206},"rest":"https://alion.io/mcp/rest/get_company?id=5206"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxero-senior-security-operations-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxero-senior-security-operations-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxero-senior-security-operations-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xero-senior-security-operations-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxero-senior-security-operations-analyst"}]}