Flexa
Discover companiesFind a jobResourcesSign in/up
For employers
< Back to search
Maersk

Cyber Technical Lead

Location:  GB - Maidenhead | United Kingdom
Location flexibility:  1 office day / week, 2 office days / week
Hey there, we’re really sorry but this job is no longer available. Please take a look at our other roles, and check back again soon as we’re adding new roles all the time!

Vodafone

SOC Lead - Cyber Security Operations - VOIS

Bangalore, IN

#1 MOST LOVED - ENTERPRISE COMPANIES

Vodafone

Security Expert

Bucuresti, RO

#1 MOST LOVED - ENTERPRISE COMPANIES

Tesco

Security Analyst III - SOC

Welwyn Garden City, UK

EY UK

Cyber Defense Incident Responder - Assistant Director

Manchester, UK

#2 MOST INCLUSIVE COMPANY

ASOS

SOC and Incident Response Lead

London, UK

#2 MOST LOVED - MID-SIZE COMPANIES

Job Description

Join Maersk’s Groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose. You won’t just work on IR; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

  • Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.
  • Multidimension role to Keep You Engaged: Unlike any traditional Incident Response type roles, as a CERT analyst in Maersk, you’ll engage in a variety of activities, switching between defensive and offensive strategies, conducting threat hunts, and participating in innovative projects and research. This multifaceted approach ensures you won’t experience burnout often associated with Incident Response.
  • Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.
  • Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.
Apply
Flex spring

Join the mailing list

Get the latest insights and expert guidance on job hunting, career progression, and creating thriving workplaces.

Enter your email
  • About us
  • Contact us
  • FAQs
  • Info for employers
  • Join Flexa
  • Legal
  • Live feed
  • Resources
  • Sign in/up
  • The Flexa awards
Flexa
  • Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.

    • Key responsibilities

    Incident Response and Leadership

    • Act as the principal technical point of contact for all cyber security matters, providing expertise to senior engineers and analysts.
    • Act as the principal escalation point for the most complex and high-risk incidents, driving resolution with precision and technical depth.
    • Leading the cyber Incident Response process from a technical perspective and effective management of high-priority cyber incidents.
    • Supporting the Incident Manager in driving post-incident reviews
    • Collaborate with global stakeholders in technical conversations, to align response efforts and communicate effectively across technical audiences during incidents.

    Continuous Improvement

    • Identify gaps and continuously improve detection and response capabilities by creating and fine-tuning use cases, developing automation and documenting processes and playbooks.
    • Identifying lessons learned to improve future incident response and detection strategies.
    • Contribute to development of detection mechanisms for sophisticated adversarial techniques based on the MITRE ATT&CK framework.

    Purple Teaming and Advanced Testing

    • Lead purple teaming exercises to integrate offensive and defensive strategies, driving measurable improvements in detection and response.
    • Architect and execute advanced attack simulations, employing state-of-the-art offensive tools and TTPs to test organizational resilience.
    • Develop scenarios and artifacts that mimic real-world adversary groups for simulated testing.

    Leadership and Team Development

    • Mentor and coach a multidisciplinary team of analysts and investigators, from a technical perspective.
    • Lead CTF exercises or other similar initiatives to maintain continuously development of team skills.
    • Champion new technologies and run coaching sessions to cross skill team members.
    • Assist the leadership team with quality control and feedback reviews.
    • Develop training materials and deliver training as part of the team’s continuous development.
    • Conduct and participate in Cyber Incident Response exercises.

    Required experience & skills

    Technical Skills and Knowledge:

    • Incident Response:
      • Ability to conduct thorough host and network investigations to analyze and mitigate malicious activities using tools like Sysinternals, Wireshark, and TCPDump.
      • Strong log analysis skills across various platforms, including OS, web applications, network devices, and security tools (e.g., Anti-malware, EDR, IPS, IDS, WAF, email protection, DLP, routers, load balancers, and proxies).
    • Cloud Security Knowledge:
      • Strong knowledge of cloud technologies and security (e.g., AWS, Azure, Alibaba, Google Cloud), with skills in performing investigations, log analysis, and incident response.
    • OT/IOT:
      • Understanding of OT environment and security is desirable but not essential.
    • OS Security Knowledge:
      • Deep understanding of operating systems, OS-level exploits, and cybersecurity for Windows and Linux, including OS hardening techniques.
      • Ability to locate, analyze, and interpret forensic artifacts in Windows and Linux during investigations (e.g., registry, event logs, browser history, memory dumps) using tools like Volatility and FTK.
    • Application Security Knowledge:
      • Familiarity with application-level attacks, prevention methods, hardening configurations, and log analysis for applications like web applications and databases.
      • Proficiency in scripting languages (e.g., Bash, Python, PowerShell) for automation and process improvement.
      • Strong understanding of malware behavior, persistence mechanisms, and the ability to perform static and dynamic analysis, including sandbox report interpretation and reverse engineering.
    • Purple Teaming:
      • Knowledge of various cyber attacks, simulations, and identification methods.
      • Ability to lead purple teaming activities, developing scenarios and engaging in both blue and red team activities. Proficiency with offensive tools like Metasploit, Nmap, Cobalt Strike, Hydra, John the Ripper, Burp Suite, Mimikatz, Bloodhound, and others.
    • Threat Hunting:
      • Experience with advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) mapped to the cyber kill chain.
      • Create hypotheses for proactive threat hunts and utilize tools like MISP and Jupyter Notebook for effective hunts.
    • Process Development:
      • Develop playbooks and templates for incident management.
      • Identify and address gaps in current processes, collaborate with other teams, and build streamlined cross-departmental processes.
    • Automation Development:
      • Identify repetitive tasks and develop automation ideas.
      • Collaborate with automation teams to build capabilities using platforms like CrowdStrike Fusion, AWS Lambda, Azure Logic Apps, XSOAR, and Python scripts.
    • Languages:
      • Query Languages: Proficiency in query languages like KQL and Logscale for investigations and log analysis.
      • Scripting Languages: Proven experience in scripting.
    • Managing Relationships:
      • Develop and maintain key relationships with forensics, security operations governance, cyber defence engineering, risk and compliance, IT, and other business units.

    Soft Skills:

    • Operations Management & Issue Resolution: Ensure smooth operations and continuity by proactively identifying and addressing operational issues, team dynamics, and inefficiencies in ticket handling.
    • Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level).
    • Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner.
    • Mentorship: training and guiding junior team members, promoting a culture of knowledge sharing and continuous learning.
    • Critical Thinking, Adaptability & Problem-Solving: Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems.
    • Time Management & Organization: Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity.
    • Teamwork & Positive Attitude: Foster a collaborative environment where team members feel supported, practicing active listening, motivating the team, and maintaining a positive demeanor, especially in high-pressure situations.

    Qualifications:

    • 7+ years of experience in cybersecurity, with a minimum of 3 years in a SOC or incident response leadership role.
    • Relevant advanced certifications (e.g., GCIA, GSEC, CEH, GCDA, GCIH, GCFA, OSCP) are highly desirable but not essential.
    • Proven self-learning abilities demonstrated through research, GitHub projects, bug hunting, active participation in public cybersecurity forums, or high scores on platforms like HTB, Immersive Labs, TryHackMe, and SANS CTF.

    Bonus Points:

    • Knowledge of reverse engineering tools (disassemblers, decompilers, debuggers) and processes (unpacking malware, reconstructing code logic, etc).
    • Low-level programming experience for example, C, Python, Go, and/or other languages desirable
    • Assembly language knowledge is a plus.
    • Experience in User-Interface/User-Experience (UI/UX) design and development.
    • Development and deployment of dockerized applications.
    • 3 years of experience in static and dynamic malicious code reverse engineering.
    • Experience with multiple platforms (Linux, MacOS, mobile, etc.) is a plus.
    • A background in intelligence is a plus.

    #LI-SS1

    Maersk is committed to a diverse and inclusive workplace, and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race, colour, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability, medical condition, pregnancy or parental leave, veteran status, gender identity, genetic information, or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

    We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website, apply for a position, or to perform a job, please contact us by emailing accommodationrequests@maersk.com.

    Working at Maersk

    1 office day / week 2 office days / week

    A little flex time

    Company employees:

    100,000+

    Gender diversity (m:f):

    65:35

    Hiring in countries

    Algeria

    Australia

    Bangladesh

    Belgium

    Brazil

    Cambodia

    Canada

    Chile

    China

    Colombia

    Costa Rica

    Croatia

    Czechia

    Denmark

    Ecuador

    Egypt

    Office Locations

    Company benefits

    Open to part time work for some roles
    Open to compressed hours
    In house training
    Health insurance
    Dental coverage
    Mental health platform access
    Compassionate leave
    Life assurance
    Annual bonus
    Referral bonus
    Employee assistance programme
    Employee discounts
    Adoption leave
    Private GP service
    Buy or sell annual leave
    Religious celebration leave
    401K
    Annual pay rises
    Enhanced pension match/contribution
    Learning platform
    Mentoring
    Enhanced maternity leave
    Shared parental leave
    Women’s health leave
    L&D budget
    Professional subscriptions
    Lunch and learns

    Awards & Accreditations

    3rd - Best Workplace Culture

    3rd - Best Workplace Culture

    Flexa awards 2026
    Best Workplace Benefits

    Top 10 - Best Workplace Benefits

    Flexa awards 2026

    France

    Germany

    Greece

    Hong Kong

    Hungary

    India

    Indonesia

    Ireland

    Israel

    Italy

    Japan

    Kenya

    Liberia

    Malaysia

    Mexico

    Morocco

    Myanmar (Burma)

    Namibia

    Netherlands

    New Zealand

    Nigeria

    Norway

    Panama

    Peru

    Philippines

    Poland

    Portugal

    Romania

    Saudi Arabia

    Serbia

    Singapore

    Slovakia

    Slovenia

    South Africa

    South Korea

    Spain

    Sri Lanka

    Sweden

    Switzerland

    Taiwan

    Thailand

    Türkiye

    Ukraine

    United Arab Emirates

    United Kingdom

    United States

    Vietnam