The role / impact

As a Senior Engineer in Security Defence, you'll design, build and operate the capabilities that help Xero detect and respond to security threats. You'll work across Security Operations, Security Response, CX, Product and Engineering, turning threat intelligence and security requirements into reliable, measurable security controls that keep our customers and our business safe.

You'll lead complex technical work, help shape our engineering direction, and build a culture of shared ownership and continuous learning across Security Defence and the wider Security team. It's a role for people who like to Go Bold on hard problems, backed by a team that knows how to Go Fast and figure things out together.

The team / how they connect

Security Defence sits at the centre of how Xero detects, investigates and responds to threats. The team covers detection engineering, security automation and incident response, working closely with Security Operations, Security Response and Product Engineering to turn intelligence into practical controls. It's a close knit group that shares knowledge openly, challenges assumptions constructively, and backs each other through high pressure moments.

The team is currently working on / Initially, you will focus on

• Detection, monitoring and response workflows across SIEM, SOAR, EDR and cloud security platforms

• Automation that reduces manual toil and speeds up how Security Operations respond to threats

• Ways to measure detection coverage, control effectiveness and operational reliability

• Safe, valuable ways to bring automation and AI into security engineering

Where and how you can work

This role can be based in Auckland or Wellington, offering a hybrid working model that balances local team presence with a global scope of work. You will have the flexibility to work from home while connecting with your colleagues in our modern office spaces during designated boost days.

Here are some of the things we're looking for

• You bring hands on experience designing, building and operating production security capabilities or services.

• Your programming or scripting skills, ideally in Python, help you apply sound software engineering practices to security problems.

• Security monitoring, detection, threat intelligence, incident response and automation are all areas you know well, alongside tools such as SIEM, SOAR, EDR or cloud security platforms.

• Working in cloud environments feels natural to you, particularly AWS, along with cloud logging, identity, networking and security services.

• You understand adversary behaviours and frameworks like MITRE ATT&CK, and know how to measure detection coverage and control effectiveness.

• Leading complex technical initiatives and influencing outcomes without relying on formal authority comes naturally, and you can explain technical risk and trade offs with clarity.

Apply even if your experience isn't a perfect match! At Xero, we hire based on your skills, passion, and the unique perspective you can bring to enhance our culture and team.