Security Expert Leader

Vulnerability Management Expert

Xero, a global leader in cloud-based accounting and financial services, seeks an experienced Vulnerability Management Expert to lead our team in identifying, triaging, and remediating vulnerabilities across our systems and platforms.

This is a unique opportunity to join a dynamic team and make a significant impact on Xero's security posture, operational resilience, and ability to respond swiftly to evolving threats.

• Lead the Vulnerability Management Team: Ensure alignment with Xero's security engineering and risk management strategy.
• Partner with the Security Product Team: Develop and deliver the team roadmap, embedding security throughout Xero's software development lifecycle.
• Support the Complete Vulnerability Management Process: Including discovery, risk assessment, triage, remediation coordination, and reporting.
• Drive Risk-Based Prioritization of Vulnerabilities: Using contextual threat intelligence, asset criticality, and exploitability data.
• Partner with Engineering, Platform, and Product Teams: Ensure timely and effective remediation, removing roadblocks, and supporting decision-making.
• Implement Metrics and Dashboards: Providing real-time visibility of security posture, vulnerability trends, and remediation progress.
• Evaluate and Integrate Security Tooling: Such as vulnerability scanners, container/image security tools, infrastructure-as-code scanning, and runtime security platforms.
• Continuously Improve Team Processes: Reducing response time, improving consistency, and aligning with evolving threats and compliance obligations.
• Grow a High-Performing Team: Coaching, mentoring, and connecting their work directly to Xero's strategic goals.
• Provide Clarity of Direction: Supporting goal setting and development opportunities.
• Champion a Culture of Shared Responsibility: For security across the broader engineering organization.
• Empower Your Team: To operate with autonomy, make decisions, and take ownership of their work.
• Act as a Role Model: Promoting Xero's values in every aspect of work.
• Collaborate Closely: With leaders across Security, Engineering, and Platform to strengthen alignment, ways of working, and delivery rhythm.

• Your team owns and operates a modern, effective vulnerability management function that reduces risk and enables delivery.
• Delivers timely, risk-informed insights on vulnerabilities and remediation progress to engineering and leadership teams.
• Maintains high-quality data and visibility on vulnerabilities across all relevant systems and platforms.
• Succesfully embeds automated scanning and vulnerability detection into CI/CD pipelines and runtime environments.
• BUILDs strong, trusted relationships with engineering teams, enabling consistent and predictable remediation cycles.
• Reports understand how their work contributes to reducing risk and improving Xero's overall security posture.
• Feel empowered to lead, experiment, and grow supported by strong coaching and a values-led culture.
• Continuously build their security expertise through on-the-job learning, stretch projects, and mentoring.
• Are recognised and celebrated for their contributions, while also receiving honest feedback to grow.
• Collaborate proactively across teams, breaking silos, and championing shared security ownership.
• Clearly understand how their work contributes to Xero's security and business success.
• Clearly understand their areas of development and their personal growth. Feel supported in their career growth and technical development.

• Strong domain expertise in vulnerability management, detection engineering, or security operations.
• Experience operating or leading a vulnerability management program at scale, preferably in a cloud-native or SaaS environment.
• Familiarity with security tooling such as Qualys, Tenable, Wiz, or similar; and integration into CI/CD and DevOps workflows.
• Coaching and mentoring skills.
• A growth mindset and love of learning.