A.P. Moller - Maersk Logo

A.P. Moller - Maersk

Incident Analyst - Cyber

Posted 12 Days Ago
Be an Early Applicant
Maidenhead, Berkshire, England
Mid level
Maidenhead, Berkshire, England
Mid level
The Incident Analyst role at Maersk involves responding to and managing cybersecurity incidents, improving detection capabilities, and actively participating in purple teaming and threat hunting. The position emphasizes continuous learning and collaboration with various teams to enhance cyber incident response processes.
The summary above was generated by AI

Join Maersk’s Groundbreaking Cyber Team: Redefining Incident Management & Response   

 

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.   

 

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose. You won’t just work on IR; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.   

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?    

  • Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.   
  • Multidimension role to Keep You Engaged: Unlike any traditional SOC role, as a CERT analyst in Maersk, you’ll engage in a variety of activities, switching between defensive and offensive strategies, conducting threat hunts, and participating in innovative projects and research. This multifaceted approach ensures you won’t experience burnout like in a typical SOC role.   
  • Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.   
  • Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.   
  • Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.   

 

Key responsibilities 

 

Cyber Incident Response and event management  

  • Contributing to the response efforts for security incidents, managing triage, containment, documentation, and the reporting process. 
  • Contribute to the Cyber Incident Response process from a technical perspective and provide effective management of all cyber incidents. 
  • Supporting the Incident Manager in driving post-incident reviews  
  • Collaborate with global stakeholders in technical conversations, to align response efforts and communicate effectively across technical audiences during incidents. 
  • Leverage Incident Analysis context to help identify gaps and improve detection and response capabilities by fine-tuning use cases, developing automation, and documenting processes. 
  • Respond to the incident and manage the tickets end to end with a good quality. 
  • Conduct host and network investigations to detect and mitigate malicious activities using tools like Sysinternals, Wireshark, and TCPDump. 
  • Log analysis across OS, web applications, network devices, and security tools (e.g., Anti-malware, EDR, IDS, WAF, DLP). 
  • Research and Intelligence Gathering: Proficiency in OSINT tools like Shodan and VirusTotal. 

 

Cloud Security Knowledge 

  • Knowledge of cloud technologies and security (e.g., AWS, Azure, Alibaba, Google Cloud), with skills in performing investigations, log analysis, and incident response is desirable  

 

OT/IOT 

  • Understanding of OT environments and security is desirable but not essential 

 

OS Security Knowledge 

  • Knowledge of operating systems, OS-level exploits, and cybersecurity for Windows and Linux, including OS hardening techniques.  
  • Knowledge of how to locate, analyze, and interpret forensic artifacts in Windows and Linux during investigations (e.g., registry, event logs, browser history, memory dumps) using tools like Volatility and FTK is desirable 

  

Application Security Knowledge 

  • Familiarity with application-level attacks, prevention methods, hardening configurations, and log analysis for applications like web applications and databases is desirable  
  • An understanding of malware behaviour, persistence mechanisms, and the ability to perform static and dynamic analysis, including sandbox report interpretation and reverse engineering.  

 

Purple Teaming 

  • Knowledge of various cyber-attacks, simulations, and identification methods.  
  • Keen to participate in purple teaming activities, helping to develop scenarios and engage in both blue and red team activities. Some experience with tooling such as Metasploit, Nmap, Cobalt Strike, Hydra, John the Ripper, Burp Suite, Mimikatz, Bloodhound, and others.  

 

Threat Hunting 

  • Ability to learn fast new advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) mapped to the cyber kill chain and apply them to incident response analysis.  
  • Create hypotheses for proactive threat hunts and utilize tools like MISP and Jupyter Notebook for effective hunts.  

 

Process Development 

  • Develop playbooks and templates for incident management.  
  • Identify and address gaps in current processes, collaborate with other teams, and build streamlined cross-departmental processes.  

 

Automation Development 

  • Identify repetitive tasks and develop automation ideas.  
  • Collaborate with automation teams to build capabilities using platforms like CrowdStrike Fusion, AWS Lambda, Azure Logic Apps, XSOAR, and Python scripts.  

 

Languages 

  • Good experience in query languages like KQL and Logscale for investigations and log analysis is highly desirable  

  

Managing Relationships:  

  • Develop and maintain key relationships with forensics, security operations governance, cyber defence engineering, risk and compliance, IT, and other business units.  

 

Soft Skills:  

  • Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level).  
  • Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner.  
  • Critical Thinking, Adaptability & Problem-Solving: Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems.  
  • Time Management & Organization: Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity. 
  • Teamwork & Positive Attitude: Foster a collaborative environment where team members feel supported, practicing active listening, motivating the team, and maintaining a positive demeanour, especially in high-pressure situations.  
  • Self-Learning: Maintain up-to-date knowledge of security trends and techniques. 

 

Qualifications 

  • 3+ years of experience in cybersecurity or similar related diciplines, with a minimum of 2 years in a SOC or incident response role, although candidates with Cyber Security know-how and able to demonstrate essential skills, may be considered.  
  • Relevant advanced certifications (e.g., GCIA, GSEC, CEH, GCDA, GCIH, GCFA, OSCP) are highly desirable but not essential.  
  • Proven self-learning abilities demonstrated through research, GitHub projects, bug hunting, active participation in public cybersecurity forums, or high scores on platforms like HTB, Immersive Labs, TryHackMe, and SANS CTF is desirable.  

 

Bonus Points: 

  • Knowledge of reverse engineering tools (disassemblers, decompilers, debuggers) and processes (unpacking malware, reconstructing code logic, etc) is desirable 
  • Some programming experience for example, C, Python, Go, and/or other languages desirable 
  • Assembly language knowledge is a plus but not essential is desirable. 
  • Experience in User-Interface/User-Experience (UI/UX) design and development is desirable but not essential 
  • Development and deployment of dockerized applications, desirable but not essential. 
  • Experience with multiple platforms (Linux, MacOS, mobile, etc) 
  • A background in intelligence is a plus. 
  • Knowledge of scripting languages is desirable (e.g., Bash, Python, PowerShell) for automation and process improvement.  

Company Benefits:

  • Flexible working arrangement: Remote working with occasional in person team building activities
  • Collaborative Culture: Experience a supportive and inclusive work environment that values teamwork and innovation. We believe in open communication and knowledge sharing, ensuring that every team member feels empowered and valued.
  • Work-Life Balance: We understand the importance of maintaining a healthy work-life balance. Our flexible working arrangements and supportive policies enable you to excel in your role while enjoying your personal life.

 

Maersk is committed to a diverse and inclusive workplace, and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race, colour, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability, medical condition, pregnancy or parental leave, veteran status, gender identity, genetic information, or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

 

We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website, apply for a position, or to perform a job, please contact us by emailing  [email protected]

Top Skills

Automation Development
AWS
Aws Lambda
Azure
Azure Logic Apps
Bash
Bloodhound
Burp Suite
C
Cloud Security
Cobalt Strike
Communication
Crowdstrike Fusion
Cybersecurity
Documentation
Ftk
Go
GCP
Hydra
Incident Analysis
John The Ripper
Kql
Log Analysis
Malware Analysis
Metasploit
Mimikatz
Nmap
Osint
Powershell
Programming
Purple Teaming
Python
Sysinternals
Tcpdump
Teamwork
Threat Hunting
Volatility
Wireshark
Xsoar

Similar Jobs

25 Days Ago
London, Greater London, England, GBR
Mid level
Mid level
AdTech • Marketing Tech
The Cyber Incidence Response Analyst will work within the cyber security team to manage and respond to security breaches and cyberattacks. Responsibilities include conducting investigations, log analysis, and collaborating with teams to enhance overall security. The role requires strong analytical skills and knowledge of cyber security threats and techniques.
Top Skills: Analytical SkillsAvCyber SecurityData CollationFirewallIncident ResponseIpsLog AnalysisProxyResearchSecurity DocumentationSIEMThreat Intelligence
10 Hours Ago
Hybrid
London, Greater London, England, GBR
Senior level
Senior level
Financial Services
As a Product Security Lead, you'll drive security culture, manage security risks, and collaborate with teams on a wide range of cybersecurity issues while ensuring compliance and enhancing product security. Your role involves acting as a thought leader, managing emerging security issues, and translating complex technical concepts for diverse stakeholders.
20 Hours Ago
Hybrid
London, Greater London, England, GBR
Senior level
Senior level
Fintech • Mobile • Payments • Software • Financial Services
The Senior Presales Consultant at Wise will design payment solutions for enterprises, engaging with stakeholders to understand their needs. The role includes presenting product demos, influencing decision-making, and driving revenue alongside sales teams, while ensuring reliable solutions are documented and customer feedback is integrated into product roadmaps.

What you need to know about the London Tech Scene

London isn't just a hub for established businesses; it's also a nursery for innovation. Boasting one of the most recognized fintech ecosystems in Europe, attracting billions in investments each year, London's success has made it a go-to destination for startups looking to make their mark. Top U.K. companies like Hoptin, Moneybox and Marshmallow have already made the city their base — yet fintech is just the beginning. From healthtech to renewable energy to cybersecurity and beyond, the city's startups are breaking new ground across a range of industries.

Sign up now Access later

Create Free Account

Please log in or sign up to report this job.

Create Free Account