{"id":3656614,"url":"https://alion.io/job/xplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3","title":"Senior Cybersecurity Engineer | Cyber Threat Intelligence & Response","company":{"id":2443,"name":"Xplor","domain":"xplortechnologies.com","url":"https://alion.io/company/xplor","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Auckland, New Zealand"],"countries":["NZ"],"hiring_countries":["NZ"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"ISO 27001","optional":false},{"name":"ITIL","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-11-02T22:38:49Z","employer_posted_date":"2026-11-02","last_verified_at":"2026-11-04T15:50:44Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Xplor Technologies powers the experiences at the heart of everyday life. Through modern vertical software, embedded payments, and AI-powered capabilities, we help businesses in fitness, recreation, golf and club, field services, laundry, education, and other membership-based and service-based industries simplify operations, uncover insights, and elevate customer and member experiences.\n About the opportunity\nOur Cyber Threat Intelligence & Response (CTIR) engineers are the people we count on when something goes wrong, and the people who make sure it goes wrong far less often. This is a hands-on incident response role. You'll lead the response to security events across our platforms and applications: triage, investigate, contain, eradicate and recover, then make sure we come out of it stronger.\nWe're looking for someone who genuinely loves incident response. Someone who gets calmer and sharper when an incident kicks off, who is confident making decisions when the picture isn't complete, and who doesn't wait to be told what to look at. If you're a self-starter who takes ownership from the first alert to the final report, you'll fit right in.\nSome of the other responsibilities include :\nOwn incidents as part of the CTIR team: detect, triage, investigate, contain and eradicate, driving each one until the threat is under control.\nWork live incidents alongside the team and be ready to step up and take the lead yourself when the situation calls for it.\nLead investigations across our systems, digging into logs, endpoints, email and network data to work out what happened, how far it reached, and how to resolve.\nPerform host and network forensics, malware triage, and email analysis (including PDF and document analysis) to understand attacker activity and build a reliable timeline.\nCoordinate with engineering, IT and the wider security team during a response, and communicate clearly to both technical teams and leadership.\nHunt proactively for threats across system logs, user behaviour and threat intelligence, turning what you find into new detections and indicators of compromise.\nBuild and automate incident response workflows and playbooks so routine response is fast and repeatable.\nStrengthen our detection coverage using the MITRE ATT&CK framework, closing monitoring gaps, and tuning to reduce noise.\nFeed what you learn from each incident back into how the team detects and responds, so an attack pattern we've seen once is caught faster next time.\nAnalyse threat intelligence, research emerging threats, and recommend practical mitigation.\nBe ready to work incidents as they arise, including on-call and out-of-hours cover when needed.\nFor this position, you'll work fully remote. You need to be based in NZ and have full working rights for this region.\n What would make me a good candidate?\nWe are looking for curious and empathetic people. We also love to hear from people who are motivated by meaningful work, resonate with our four core values, have a positive outlook, are comfortable with ambiguity and thrive working in an ever-evolving and complex environment. We are inspired by meeting big picture thinkers and doers, people who can be both tactical and strategic, aim high and put people first in everything they do.\nPeople who want to make a real difference in security, and who care about incident response in particular.\n3 to 6 years experience in security operations or incident response, with genuine passion for running incidents, not just watching a queue.\nConfidence managing incidents through the full incident-handling lifecycle, and the judgement to make sound calls under pressure.\nStrong triage and root cause analysis, with a solid understanding of different log sources and how to correlate events across them.\nComfortable reading logs (HTTP, SMTP, network), Windows and Active Directory, and common operating systems and servers.\nHands-on experience with a SIEM to investigate, hunt and build detections. Microsoft Sentinel and KQL preferred.\nPractical experience across EDR, advanced threat protection, identity management and API security.\nThreat-hunting experience across network flow, user behaviour and threat intelligence, plus the ability to design new ways to detect and contain attacks using scripting, analytics and automation.\nFamiliar with a broad range of attacker tools and techniques (TTPs), with the ability to map adversary activity across the Cyber Kill Chain to identify, assess, and communicate potential attack progression.\nA self-starter who works independently, delivering projects without being chased, and keeps learning as the industry develops.\nA critical thinker with strong problem-solving instincts and exceptional communication skills, capable of translating complex technical risks into clear, actionable insights for both the immediate team and cross-functional partners, including engineers, administrators, and leadership, through both verbal and written communication.\nGood understanding of ITIL processes and standards such as ISO 27001 and PCI DSS, including change, incident and problem management.\nNice to have :\nMalware analysis experience.\nPreferred certifications such as GCIH, GCFA, AZ-500 or SC-100.\nExperience with Jupyter Notebooks for threat-hunting.\nPython and PowerShell scripting.\nExperience building and tuning SOAR automation for response.\nAt Xplor, we believe the best innovation and ideas happen at the intersections of our differences - across cultures, generations, disciplines, and lived experiences. So even if you do not tick every box, we still encourage you to apply.\n Values and Life at Xplor\nOur five core values guide us from how we hire and recognise our team members to how we interact with our customers day to day:\nFind a better way\nDo the right thing\nSay it straight\nWin together\nOwn the outcome\nIf these values sound like you, and describe people you want to work with, you will thrive at Xplor.\nAs an Xplorer, you will be part of a global network of talented colleagues who will support your success. We look for commonalities and shared passions and give people the tools they need to deliver great work and grow at speed.\nSome of our perks and benefits are:\nPaid Parental Leave benefit programs\n#GiveBackDays/Commitment to social impact - 3 extra days off to volunteer and give back to your local community\nOngoing dedication to Diversity & Inclusion initiatives such as D&I Council, Global Mentorship Program\nAccess to free mental health support\nFlexible working arrangements\nReady to apply?\nTo start your application, please submit your resume and we will be in touch as soon as we can. Please include the word \"moonshot\" at the top of your message to the Hiring Manager so that we know you took the time to read our job ad.\nWe understand that diverse candidates have diverse needs. We welcome you to inform us of any additional needs related to completing your job application or participating in the interview process, via .\nBefore you apply\nTo be considered for employment, you must be legally authorised to work in the country where the role is advertised. This applies to remote roles too. Xplor does not sponsor visas, either at the time of hire or at any later time. We're also not able to offer contractor arrangements or Employer of Record engagements for this position at this stage.\nPlease apply through our careers portal or external job boards only. We're unable to upload emailed applications, as our process requires you to answer screening questions directly.\nWe also invite you to check out our Candidate FAQs for more information about our recruitment process xplor.com/recruitment-faqs/.\nInterview Recording and Background Checks\nAs part of our hiring process, successful candidates will be asked to complete background and identity verification checks. Many of our roles are remote, and to protect both candidates and our business from recruitment fraud, we may record video interviews during the process. We keep any recordings and related data only for as long as the hiring process is active and do not retain them afterwards.\nEEO and Artificial Intelligence\nWe believe in transparent hiring. We use an applicant tracking system with artificial intelligence-enabled features to support our recruitment process, but our recruitment team makes all hiring decisions after human review. We do not rely on artificial intelligence to make final hiring decisions. Find our Candidate AI Usage guidelines here.\nXplor is dedicated to attracting, retaining and developing our people regardless of gender identity, ethnicity, sexual orientation, disability and age. Applications are encouraged from all sectors of the community and we particularly encourage speakers of Te Reo Māori or Pasifika languages to apply.\nWe make it a priority to respond to every applicant.","description_format":"text","description_chars":8849,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Flexible schedule","Parental leave"],"hiring_locations":[{"name":"New Zealand","iso":"NZ","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Threat Intelligence","Information Security","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-11-03T02:06:07Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":40,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/xplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3","json_url":"https://alion.io/job/xplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3.json","meta":{"generated_at":"2026-11-04T19:31:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30059,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2443},"rest":"https://alion.io/mcp/rest/get_company?id=2443"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxplor-senior-cybersecurity-engineer-cyber-threat-intelligence-response-3"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3656614}},{"tool":"search_jobs","arguments":{"company":"xplortechnologies.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3656614},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}