Senior Security Operations Analyst

The role

You will lead complex investigations and act as Incident Commander for medium and high impact incidents. You will also build automations and AI-assisted workflows to improve the SOC.

What you will do

• Lead complex investigations and step up as Incident Commander for medium and high impact incidents
• Be a go-to escalation point for Graduate, Associate and Analyst crew
• Run post incident reviews that lead to change in detections, runbooks and training
• Lead initiatives with the Product Manager and Security Operations Managers
• Build and improve automations and AI-assisted workflows
• Work with Defence engineers on detection and response logic
• Turn threat intelligence into practical action
• Give customers and internal teams clear, timely answers to security concerns

Required qualifications

• Solid experience in security operations
• Track record of leading complex investigations and incidents through to resolution
• Sound technical judgement and knowledge of attack and defence techniques in cloud and SaaS environments
• Confidence writing queries in a SIEM or log platform
• Clear, calm communication

Nice to have

• Scripting skills (Python or similar)
• Experience building automations in a SOAR platform
• Hands-on experience with AI tools in security work
• Intermediate or advanced certifications in incident response, threat hunting or cloud security
• Experience in a distributed team working across time zones

Benefits

• Flexible working model
• Option to work in a hybrid capacity

About the company

Xero is a company where the Response team is first on the scene when something goes wrong in security. The work impacts millions of small businesses and their advisors.