Senior Cybersecurity Engineer | Cyber Threat Intelligence & Response

Xplor

5d • Remote

About The Position

Xplor Technologies is seeking a Senior Cybersecurity Engineer to join its Cyber Threat Intelligence & Response (CTIR) team. This is a hands-on incident response role focused on leading security-event response across the company’s platforms and applications, from triage and investigation through containment, eradication, and recovery. The engineer will also use lessons from incidents to improve detection and response capabilities.

The role involves working live incidents with the CTIR team and taking the lead when needed. The engineer will investigate logs, endpoints, email, and network data; perform host and network forensics, malware triage, and email analysis; hunt for threats; develop detections and response automation; and coordinate with engineering, IT, security colleagues, and leadership. The role includes on-call and out-of-hours incident coverage when needed.

The position is fully remote, and candidates must be based in New Zealand and have full working rights for the region. Xplor does not sponsor visas and is unable to offer contractor or Employer of Record arrangements for this position.

Requirements

• Three to six years of experience in security operations or incident response, with a strong interest in running incidents.
• Ability to manage incidents across the full incident-handling lifecycle and make sound decisions under pressure.
• Strong triage and root-cause analysis skills, including understanding log sources and correlating events across them.
• Ability to read HTTP, SMTP, and network logs and familiarity with Windows, Active Directory, common operating systems, and servers.
• Hands-on SIEM experience investigating, threat hunting, and building detections.
• Practical experience with EDR, advanced threat protection, identity management, and API security.
• Threat-hunting experience involving network flow, user behavior, and threat intelligence.
• Ability to design ways to detect and contain attacks using scripting, analytics, and automation.
• Familiarity with attacker tools and techniques (TTPs) and ability to map adversary activity across the Cyber Kill Chain to assess and communicate attack progression.
• Self-starter who can work independently, deliver projects without being chased, and continue learning as the industry develops.
• Critical thinking and problem-solving skills, with strong verbal and written communication and the ability to translate technical risks into clear, actionable insights for technical and cross-functional audiences.
• Good understanding of ITIL processes and standards such as ISO 27001 and PCI DSS, including change, incident, and problem management.
• Must be based in New Zealand and have full working rights for the region.

Nice To Haves

• Microsoft Sentinel and KQL experience.
• Malware analysis experience.
• Certifications such as GCIH, GCFA, AZ-500, or SC-100.
• Experience using Jupyter Notebooks for threat hunting.
• Python and PowerShell scripting experience.
• Experience building and tuning SOAR automation for response.

Responsibilities

• Detect, triage, investigate, contain, and eradicate security incidents, and drive each incident until the threat is under control.
• Work live incidents with the CTIR team and lead responses when required.
• Investigate systems by analyzing logs, endpoints, email, and network data to determine what happened, the scope of an incident, and how to resolve it.
• Perform host and network forensics, malware triage, and email analysis, including PDF and document analysis, to understand attacker activity and establish timelines.
• Coordinate incident response with engineering, IT, and the wider security team, communicating clearly with technical teams and leadership.
• Proactively hunt for threats across system logs, user behavior, and threat intelligence, and turn findings into detections and indicators of compromise.
• Build and automate incident-response workflows and playbooks to make routine response faster and repeatable.
• Strengthen detection coverage using the MITRE ATT&CK framework, address monitoring gaps, and tune detections to reduce noise.
• Apply lessons from incidents to improve detection and response and help ensure previously observed attack patterns are identified more quickly.
• Analyze threat intelligence, research emerging threats, and recommend practical mitigations.
• Provide on-call and out-of-hours incident coverage when needed.

Benefits

• Paid parental leave benefit programs.
• Three extra days off for volunteering and local community contributions (#GiveBackDays).
• Diversity and inclusion initiatives, including a D&I Council and Global Mentorship Program.
• Access to free mental health support.
• Flexible working arrangements.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed