# Senior Cybersecurity Engineer | Cyber Threat Intelligence & Response **Company**: Xplor **Location**: Auckland, Auckland **Work arrangement**: remote **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://jobs.smartrecruiters.com/Xplor/744000159258939-senior-cybersecurity-engineer-cyber-threat-intelligence-response?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_00254c69-d3f ## Description Xplor Technologies powers the experiences at the heart of everyday life. Through modern vertical software, embedded payments, and AI-powered capabilities, we help businesses in fitness, recreation, golf and club, field services, laundry, education, and other membership-based and service-based industries simplify operations, uncover insights, and elevate customer and member experiences. Our Cyber Threat Intelligence & Response (CTIR) engineers are the people we count on when something goes wrong, and the people who make sure it goes wrong far less often. This is a hands-on incident response role. You'll lead the response to security events across our platforms and applications: triage, investigate, contain, eradicate and recover, then make sure we come out of it stronger. Responsibilities: - Own incidents as part of the CTIR team: detect, triage, investigate, contain and eradicate, driving each one until the threat is under control. - Work live incidents alongside the team and be ready to step up and take the lead yourself when the situation calls for it. - Lead investigations across our systems, digging into logs, endpoints, email and network data to work out what happened, how far it reached, and how to resolve. - Perform host and network forensics, malware triage, and email analysis (including PDF and document analysis) to understand attacker activity and build a reliable timeline. - Coordinate with engineering, IT and the wider security team during a response, and communicate clearly to both technical teams and leadership. - Hunt proactively for threats across system logs, user behaviour and threat intelligence, turning what you find into new detections and indicators of compromise. - Build and automate incident response workflows and playbooks so routine response is fast and repeatable. - Strengthen our detection coverage using the MITRE ATT&CK framework, closing monitoring gaps, and tuning to reduce noise. - Feed what you learn from each incident back into how the team detects and responds, so an attack pattern we've seen once is caught faster next time. - Analyse threat intelligence, research emerging threats, and recommend practical mitigation. - Be ready to work incidents as they arise, including on-call and out-of-hours cover when needed. Qualifications: - 3 to 6 years experience in security operations or incident response, with genuine passion for running incidents, not just watching a queue. - Confidence managing incidents through the full incident-handling lifecycle, and the judgement to make sound calls under pressure. - Strong triage and root cause analysis, with a solid understanding of different log sources and how to correlate events across them. - Comfortable reading logs (HTTP, SMTP, network), Windows and Active Directory, and common operating systems and servers. - Hands-on experience with a SIEM to investigate, hunt and build detections. Microsoft Sentinel and KQL preferred. - Practical experience across EDR, advanced threat protection, identity management and API security. - Threat-hunting experience across network flow, user behaviour and threat intelligence, plus the ability to design new ways to detect and contain attacks using scripting, analytics and automation. - Familiar with a broad range of attacker tools and techniques (TTPs), with the ability to map adversary activity across the Cyber Kill Chain to identify, assess, and communicate potential attack progression. - A self-starter who works independently, delivering projects without being chased, and keeps learning as the industry develops. - A critical thinker with strong problem-solving instincts and exceptional communication skills, capable of translating complex technical risks into clear, actionable insights for both the immediate team and cross-functional partners, including engineers, administrators, and leadership, through both verbal and written communication. - Good understanding of ITIL processes and standards such as ISO 27001 and PCI DSS, including change, incident and problem management. Nice to have: - Malware analysis experience. - Preferred certifications such as GCIH, GCFA, AZ-500 or SC-100. - Experience with Jupyter Notebooks for threat-hunting. - Python and PowerShell scripting. - Experience building and tuning SOAR automation for response. Benefits: - Paid Parental Leave benefit programs - #GiveBackDays/Commitment to social impact – 3 extra days off to volunteer and give back to your local community - Ongoing dedication to Diversity & Inclusion initiatives such as D&I Council, Global Mentorship Program - Access to free mental health support - Flexible working arrangements ## Skills ### Required - incident response - security operations - threat intelligence - SIEM - EDR - API security - threat hunting - scripting - analytics - automation - MITRE ATT&CK framework - ITIL processes - ISO 27001 - PCI DSS ### Nice to have - malware analysis - GCIH - GCFA - AZ-500 - SC-100 - Jupyter Notebooks - Python - PowerShell - SOAR automation --- Source: [Apply at jobs.smartrecruiters.com](https://jobs.smartrecruiters.com/Xplor/744000159258939-senior-cybersecurity-engineer-cyber-threat-intelligence-response?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)