Intermediate Security Engineer (Application Security)

The role and it’s impact

Sitting within a newly formed Application Security team, this role will focus on secure software development, DevSecOps, security automation, and vulnerability management.

We're looking for somebody with a passion for security automation and security-as-code, who can leverage tools to improve efficiency. Coupled with a growth mindset, continuously learning and adapting to emerging threats and security trends.

This position will play a key role in securing Xero’s software development lifecycle (SDLC), ensuring that security is embedded into engineering workflows while enabling teams to deliver secure products at scale.

The team & how they connect

You will join the Application Security team, a group dedicated to advancing DevSecOps and secure software delivery. Working cross-functionally with engineering, product, and platform teams, you will champion a culture where security is automated, collaborative, and widely understood across the business.

The team is currently working on

• Integrating automated testing tools (SAST, DAST, SCA) into CI/CD pipelines to identify vulnerabilities early.

• Building and managing security automation tools that fit effortlessly into existing developer workflows.

• Collaborating with platform teams to secure APIs, cloud infrastructure, and serverless architectures.

• Driving