Senior Security Engineer - Defence

The role / impact

As a Senior Engineer in Security Defence, you'll design, build and operate the capabilities that help Xero detect and respond to security threats. You'll work across Security Operations, Security Response, CX, Product and Engineering, turning threat intelligence and security requirements into reliable, measurable security controls that keep our customers and our business safe.

You'll lead complex technical work, help shape our engineering direction, and build a culture of shared ownership and continuous learning across Security Defence and the wider Security team. It's a role for people who like to Go Bold on hard problems, backed by a team that knows how to Go Fast and figure things out together.

The team / how they connect

Security Defence sits at the centre of how Xero detects, investigates and responds to threats. The team covers detection engineering and security automation, working closely with Security Operations, Security Response and Product Engineering to turn intelligence into practical controls. It's a close knit group that shares knowledge openly, challenges assumptions constructively, and backs each other through high pressure moments.

The team is currently working on / Initially, you will focus on

• Detection, monitoring and response workflows across SIEM, SOAR, EDR and cloud security platforms
• Automation that reduces manual toil and speeds up how Security Operations respond to threats
• Ways to measure detection coverage, control effectiveness and operational reliability
• Safe, valuable ways to bring automation and AI into security engineering

Where and how you can work

We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment.

Here are some of the things we're looking for

• You bring hands on experience designing, building and operating production security capabilities or services.
• Your programming or scripting skills, ideally in Python, help you apply sound software engineering practices to security problems.
• Security monitoring, detection, threat intelligence, incident response and automation are all areas you know well, alongside tools such as SIEM, SOAR, EDR or cloud security platforms.
• Working in cloud environments feels natural to you, particularly AWS, along with cloud logging, identity, networking and security services.
• You understand adversary behaviours and frameworks like MITRE ATT&CK, and know how to measure detection coverage and control effectiveness.
• Leading complex technical initiatives and influencing outcomes without relying on formal authority comes naturally, and you can explain technical risk and trade offs with clarity.