Senior Security Engineer - Cloud Platform

Responsibilities

• Design and operate identity and access controls at scale: Architect and maintain cloud-native identity and access management systems across AWS, GCP, and Azure, implementing secure-by-default controls and establishing governance frameworks that prevent privilege escalation and eliminate long-lived credentials at scale.
• Conduct IAM security assessments and gap analysis: Audit current identity and access management setups across public cloud environments, identify security risks and vulnerabilities, and develop actionable remediation strategies to strengthen organizational access controls.
• Build and maintain reusable Terraform modules and policy frameworks: Design and evolve Infrastructure as Code patterns that standardize secure access controls, create self-service capabilities, and reduce manual IAM configuration while maintaining consistent security posture across cloud platforms.
• Implement Workload Identity Federation and bounded IAM: Close critical identity handover gaps by deploying Workload Identity Federation solutions, implementing bounded IAM principles, and establishing self-service identity tools that enable teams to manage access securely without excessive privilege.
• Mentor and develop team engineers: Provide technical leadership, code reviews, and knowledge transfer to team members; model modern engineering practices, foster psychological safety, and help lift engineering standards across identity and access management implementations.
• Establish KPI baselines and contribute to design reviews: Define measurable security metrics for IAM systems, participate in architectural design reviews, contribute to incident response and post-mortems, and drive continuous improvement through data-driven insights and operational excellence.
• Collaborate across platform, security, and product teams: Work cross-functionally with platform engineering, application security, and product teams to integrate identity controls early in the delivery lifecycle, enabling rapid and secure feature deployment while maintaining governance standards.
• Develop internal tooling and automation: Create and maintain automation scripts, internal tools, and operational dashboards that reduce toil in IAM management, improve visibility into identity controls, and enable self-service access management capabilities for engineering teams.

Benefits

• Hybrid work flexibility

  Work from home with designated boost days in modern office spaces in Auckland or Wellington, allowing collaboration with local team members while maintaining flexibility and work-life balance.

• Professional development and mentorship

  Access to learning opportunities, technical mentorship, and career growth support as part of a high-performing platform security team dedicated to engineering excellence.

• Psychological safety and inclusive culture

  Work in an environment that values psychological safety, diverse perspectives, and blameless post-mortems, enabling teams to take calculated risks and learn from incidents without fear.

• Cloud platform access and learning budget

  Opportunity to gain hands-on experience with multiple cloud platforms (AWS, GCP, Azure) and invest in certifications and continuous learning in cloud security and identity technologies.

• Impact and influence at scale

  High-leverage work that directly influences organizational security posture and developer productivity, shaping secure access as a product rather than a process.

• Cross-functional collaboration

  Opportunity to work alongside platform engineers, security specialists, and product teams, building relationships and solving problems at the intersection of infrastructure and security.

• Equity and ownership

  Participation in company equity programs, aligning personal growth with organizational success as part of Xero's global scale-up journey in cloud accounting software.