A.P. Moller - Maersk | TAFFin.Tech

Company Name: A.P. Moller - Maersk
Job Title: Technical Lead
Job Description: Join Maersk’s groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose. You won’t just work on IR; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.
Multidimension role to Keep You Engaged: Unlike any traditional Incident Response type roles, as a CERT analyst in Maersk, you’ll engage in a variety of activities, switching between defensive and offensive strategies, conducting threat hunts, and participating in innovative projects and research. This multifaceted approach ensures you won’t experience burnout often associated with Incident Response.
Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.
Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.
Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.

Key Responsibilities

Incident Response and Leadership

Act as the principal technical point of contact for all cyber security matters, providing expertise to senior engineers and analysts.
Act as the principal escalation point for the most complex and high-risk incidents, driving resolution with precision and technical depth.
Leading the cyber Incident Response process from a technical perspective and effective management of high-priority cyber incidents.
Supporting the Incident Manager in driving post-incident reviews
Collaborate with global stakeholders in technical conversations, to align response efforts and communicate effectively across technical audiences during incidents.

Continuous Improvement

Identify gaps and continuously improve detection and response capabilities by creating and fine-tuning use cases, developing automation and documenting processes and playbooks.
Identifying lessons learned to improve future incident response and detection strategies.
Contribute to development of detection mechanisms for sophisticated adversarial techniques based on the MITRE ATT&CK framework.

Purple Teaming and Advanced Testing

Lead purple teaming exercises to integrate offensive and defensive strategies, driving measurable improvements in detection and response.
Architect and execute advanced attack simulations, employing state-of-the-art offensive tools and TTPs to test organizational resilience.
Develop scenarios and artifacts that mimic real-world adversary groups for simulated testing.

Leadership and Team Development

Mentor and coach a multidisciplinary team of analysts and investigators, from a technical perspective.
Lead CTF exercises or other similar initiatives to maintain continuously development of team skills.
Champion new technologies and run coaching sessions to cross skill team members.
Assist the leadership team with quality control and feedback reviews.
Develop training materials and deliver training as part of the team’s continuous development.
Conduct and participate in Cyber Incident Response exercises.

Required Experience & Skills

Technical Skills and Knowledge:

Incident Response:
Ability to conduct thorough host and network investigations to analyze and mitigate malicious activities using tools like Sysinternals, Wireshark, and TCPDump.
Strong log analysis skills across various platforms, including OS, web applications, network devices, and security tools (e.g., Anti-malware, EDR, IPS, IDS, WAF, email protection, DLP, routers, load balancers, and proxies).

Cloud Security Knowledge:
Strong knowledge of cloud technologies and security (e.g., AWS, Azure, Alibaba, Google Cloud), with skills in performing investigations, log analysis, and incident response.

OT/IOT:
Understanding of OT environment and security is desirable but not essential.

OS Security Knowledge:
Deep understanding of operating systems, OS-level exploits, and cybersecurity for Windows and Linux, including OS hardening techniques.
Ability to locate, analyze, and interpret forensic artifacts in Windows and Linux during investigations (e.g., registry, event logs, browser history, memory dumps) using tools like Volatility and FTK.

Application Security Knowledge:
Familiarity with application-level attacks, prevention methods, hardening configurations, and log analysis for applications like web applications and databases.
Proficiency in scripting languages (e.g., Bash, Python, PowerShell) for automation and process improvement.
Strong understanding of malware behavior, persistence mechanisms, and the ability to perform static and dynamic analysis, including sandbox report interpretation and reverse engineering.

Purple Teaming:
Knowledge of various cyber attacks, simulations, and identification methods.
Ability to lead purple teaming activities, developing scenarios and engaging in both blue and red team activities. Proficiency with offensive tools like Metasploit, Nmap, Cobalt Strike, Hydra, John the Ripper, Burp Suite, Mimikatz, Bloodhound, and others.

Threat Hunting:
Experience with advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) mapped to the cyber kill chain.
Create hypotheses for proactive threat hunts and utilize tools like MISP and Jupyter Notebook for effective hunts.

Process Development:
Develop playbooks and templates for incident management.
Identify and address gaps in current processes, collaborate with other teams, and build streamlined cross-departmen...

Maidenhead, United Kingdom

On site

03-03-2025

Company Name: A.P. Moller - Maersk
Job Title: Incident Manager
Job Description: Join Maersk’s groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose. You won’t just work on Incident Management; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.
Multidimension role to Keep You Engaged: Unlike any traditional SOC role, as a CERT analyst in Maersk, you’ll engage in a variety of activities, switching between defensive and offensive strategies, conducting threat hunts, and participating in innovative projects and research. This multifaceted approach ensures you won’t experience burnout like in a typical SOC role.
Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.
Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.
Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.

About the role:

Incident Response and Leadership

Lead incident management activities in response to all high priority cyber-security incidents, with the ability to remain calm and focused during crisis situations.
Ability to manage conflicting priorities and multiple tasks in a high-pressure environment.
Strong leadership skills with the ability to motivate and manage response teams during high-pressure situations.
Co-ordinate resources across the organisation to develop and execute response plans that ensure cyber-security incidents are managed effectively and efficiently and limit or mitigate business impact.
Communicate effectively with internal stakeholders, including senior leadership with the ability to provide rapid and concise summaries of complex situations.
Deliver and co-ordinate Post Incident activities which include producing detailed incident reports and conducting Post Incident Reviews.
Contribute to and participate in cyber-security incident readiness activities which can include simulations and tabletop exercises.

Continuous Improvement

Identify gaps and continuously improve detection and response capabilities by creating and fine-tuning use cases, developing automation and documenting processes and playbooks.
Identifying lessons learned to improve future incident response and detection strategies.
Contribute to development of detection mechanisms for sophisticated adversarial techniques based on the MITRE ATT&CK framework.

Purple Teaming and Advanced Testing

Support the planning and response of purple teaming activities.
Develop scenarios and artifacts that mimic real-world adversary groups for simulated testing.

Leadership and Team Development

Mentor and coach a multidisciplinary team of analysts and investigators, from a technical perspective.
Contribute to CTF exercises or other similar initiatives to maintain continuously development of team skills.
Champion new processes and run coaching sessions to cross skill team members.
Assist the leadership team with quality control and feedback reviews.
Develop training materials and deliver training as part of the team’s continuous development.
Conduct and lead in Cyber Incident Response exercises.

Soft Skills:

Operations Management & Issue Resolution: Ensure smooth operations and continuity by proactively identifying and addressing operational issues, team dynamics, and inefficiencies in ticket handling.
Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level).
Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner.
Mentorship: training and guiding junior team members, promoting a culture of knowledge sharing and continuous learning.
Critical Thinking, Adaptability & Problem-Solving: Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems.
Time Management & Organization: Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity.
Teamwork & Positive Attitude: Foster a collaborative environment where team members feel supported, practicing active listening, motivating the team, and maintaining a positive demeanour, especially in high-pressure situations.

Qualifications:

5+ years of experience in an Incident Management role, with a minimum of 3 years in a SOC or incident response leadership role.
Relevant advanced certifications (e.g., GCIA, GSEC, CEH, GCDA, GCIH, GCFA, OSCP) are highly desirable but not essential.
Proven self-learning abilities demonstrated through research, GitHub projects, bug hunting, active participation in public cybersecurity forums, or high scores on platforms like HTB, Immersive Labs, TryHackMe, and SANS CTF.

Bonus Points:

Knowledge of reverse engineering tools (disassemblers, decompilers, debuggers) and processes (unpacking malware, reconstructing code logic, etc) is desirable.
Some programming experience for example, C, Python, Go, and/or other languages desirable.
Assembly language knowledge is a plus but not essential is desirable.
Development and deployment of dockerized applications, desirable but not essential.
Experience with multiple platforms (Linux, MacOS, mobile, etc.) is a plus but not necessarily essential.
A background in ...

Maidenhead, United Kingdom

On site

03-03-2025

Company Name: A.P. Moller - Maersk
Job Title: Digital Forensics & Incident Response Analyst
Job Description: Join Maersk’s Groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical DFIR role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose.

You won’t just work on Digital Forensics, you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.
Further develop forensic capabilities in Traditional and modern cloud, OT and AI driven space
Conduct threat hunting by analysing data to identify existing threats on the network and support proactive content analysis
Support the continuous improvement of Maersk’s capability to detect and respond to incidents by collaborating with other teams across Cyber Operations
Work on key Cyber Security uplift projects, representing the Respond delivering results and embedding new capabilities into BAU
Provide a out-of-hours incident on-call technical/forensic response on a rota basis.
Provide detailed forensic RCA to key stakeholders, supporting Cyber Security Incident team during deep dive investigations and PIR.
Fulfil a key role within the Incident Management team to support Senior Technical Leads in investigation, resolution and recovery objectives
Support the 24/7 team when required in monitoring security alert feeds to detect, triage and investigate security events and classify them as incidents where appropriate
Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.
Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.
Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.

Key Responsibilities

Provide detailed forensic RCA to key stakeholders, supporting Cyber Security Incident team during deep dive investigations and PIR.
Further develop forensic capabilities in Traditional and modern cloud, OT and AI driven space
Conduct threat hunting by analysing data to identify existing threats on the network and support proactive content analysis
Support the continuous improvement of Maersk’s capability to detect and respond to incidents by collaborating with other teams across Cyber Operations
Work on key Cyber Security uplift projects, representing the Respond delivering results and embedding new capabilities into BAU
Provide a out-of-hours incident on-call technical/forensic response on a rota basis.
Fulfil a key role within the Incident Management team to support Senior Technical Leads in investigation, resolution and recovery objectives
Support the 24/7 team when required in monitoring security alert feeds to detect, triage and investigate security events and classify them as incidents where appropriate

Services Overseen

Rotation around the following:

Protective Systems Monitoring
Malicious Compromise Forensic investigation
Threat & Behavioural Analytics
Threat Hunting
Security Incident Management
Project Engagement and Delivery
Strategic Planning Input to evolve Forensics Capability

Required Experience & Skills

Technical Forensic capability across Endpoint, Cloud and OT infrastructure
Excellent written and verbal communication skills and able to be understood by both technical and non-technical stakeholders
Stakeholder management and interpersonal skills (at both a technical and non-technical level)
Ability to provide rapid and concise summaries of complex situations
Ability to work under pressure and autonomously or under general direction as required
Ability to manage conflicting priorities and multiple tasks
Outstanding critical reasoning and problem-solving skills
Excellent Event Logs analysis, i.e. Application, Security, System, PowerShell
Excellent Registry investigation skills: UserAssist, BAM, Prefetch, Amcache, Shimcasche
Good understanding of Link Files, Jumplists, Timelines forensics techniques both in Windows and Forensics
Good knowledge of forensics tooling, such as Volatility, Kape, Autopsy, Wireshark
The role holder will have proven experience working in a Security Operations Centre (SOC) and/or Computer Emergency Response Team (CERT) within a team of other analysts and engineers
Experience in Threat Hunting
Experience in Incident Management (preferred but not essential)
Practical experience in Forensic investigations
Hands on exposure to memory forensic investigations
Excellent knowledge of typical security devices such as SIEM, firewalls, etc.
Experience of working in fast-paced, high-pressure environments
Previous project engagement and execution of delivery
Excellent Investigation skills to expose, Persistence of Malware and File-less techniques in Windows, Linux
Experience in working with Volatile Data Forensics, Memory Forensics and understanding key objectives, benefits and risks associated with such investigations
Experience in both static and dynamic forensics
Experience in conducting Forensics both in small but also Enterprise scale, including but not limited to Cloud, OT and Traditional Infrastructure
Contribute to cyber incident Response management and engage in the CSIRT process for high-priority incidents.
Serve as an escalation point for junior analysts.
Deliver exceptional quality in Incident Response
Conduct thorough host and network investigations to analyze and find ways to mitigate malicious activities. You’ll be comfortable with tooling like Sysinternals, Wireshark, X-Ways and TimeSketch.
Strong log analysis skills across various platforms, including OS, web applications, network devices, and se...

Maidenhead, United Kingdom

On site

03-03-2025

Company Name: A.P. Moller - Maersk
Job Title: Incident Analyst
Job Description: Join Maersk’s Groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team approach team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that works together to defend, adapt, and innovate with freedom and purpose. You won’t just work on IR; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

Join a World-Class Cyber Team: Be part of an elite cyber operation at one of the globe’s most renowned logistics companies, where your contributions truly make a difference.
Multidimension role to Keep You Engaged: Unlike any traditional SOC role, as a CERT analyst in Maersk, you’ll engage in a variety of activities, switching between defensive and offensive strategies, conducting threat hunts, and participating in innovative projects and research. This multifaceted approach ensures you won’t experience burnout like in a typical SOC role.
Continuous Learning & Dynamic Environment: Enjoy ongoing training and development in a fast-paced, stimulating atmosphere. Participate in exciting CTF competitions alongside a team of experts, pushing the boundaries of your knowledge and skills.
Using cutting edge technologies: Tackle complex cyber incidents that require innovative solutions and utilizing the latest technologies available in the market. Your expertise will be crucial in addressing and mitigating sophisticated threats, allowing you to hone your skills in a real-world environment.
Innovate and Impact: Engage in innovative projects that allow you to bring your ideas to life, help shape the future of cybersecurity while developing new capabilities that enhance our operations.

Key Responsibilities

Cyber Incident Response and event management

Contributing to the response efforts for security incidents, managing triage, containment, documentation, and the reporting process.
Contribute to the Cyber Incident Response process from a technical perspective and provide effective management of all cyber incidents.
Supporting the Incident Manager in driving post-incident reviews
Collaborate with global stakeholders in technical conversations, to align response efforts and communicate effectively across technical audiences during incidents.
Leverage Incident Analysis context to help identify gaps and improve detection and response capabilities by fine-tuning use cases, developing automation, and documenting processes.
Respond to the incident and manage the tickets end to end with a good quality.
Conduct host and network investigations to detect and mitigate malicious activities using tools like Sysinternals, Wireshark, and TCPDump.
Log analysis across OS, web applications, network devices, and security tools (e.g., Anti-malware, EDR, IDS, WAF, DLP).
Research and Intelligence Gathering: Proficiency in OSINT tools like Shodan and VirusTotal.

Cloud Security Knowledge

Knowledge of cloud technologies and security (e.g., AWS, Azure, Alibaba, Google Cloud), with skills in performing investigations, log analysis, and incident response is desirable

OT/IOT

Understanding of OT environments and security is desirable but not essential

OS Security Knowledge

Knowledge of operating systems, OS-level exploits, and cybersecurity for Windows and Linux, including OS hardening techniques.
Knowledge of how to locate, analyze, and interpret forensic artifacts in Windows and Linux during investigations (e.g., registry, event logs, browser history, memory dumps) using tools like Volatility and FTK is desirable

Application Security Knowledge

Familiarity with application-level attacks, prevention methods, hardening configurations, and log analysis for applications like web applications and databases is desirable
An understanding of malware behaviour, persistence mechanisms, and the ability to perform static and dynamic analysis, including sandbox report interpretation and reverse engineering.

Purple Teaming

Knowledge of various cyber-attacks, simulations, and identification methods.
Keen to participate in purple teaming activities, helping to develop scenarios and engage in both blue and red team activities. Some experience with tooling such as Metasploit, Nmap, Cobalt Strike, Hydra, John the Ripper, Burp Suite, Mimikatz, Bloodhound, and others.

Threat Hunting

Ability to learn fast new advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) mapped to the cyber kill chain and apply them to incident response analysis.
Create hypotheses for proactive threat hunts and utilize tools like MISP and Jupyter Notebook for effective hunts.

Process Development

Develop playbooks and templates for incident management.
Identify and address gaps in current processes, collaborate with other teams, and build streamlined cross-departmental processes.

Automation Development

Identify repetitive tasks and develop automation ideas.
Collaborate with automation teams to build capabilities using platforms like CrowdStrike Fusion, AWS Lambda, Azure Logic Apps, XSOAR, and Python scripts.

Languages

Good experience in query languages like KQL and Logscale for investigations and log analysis is highly desirable

Managing Relationships:

Develop and maintain key relationships with forensics, security operations governance, cyber defence engineering, risk and compliance, IT, and other business units.

Soft Skills:

Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level).
Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner.
Critical Thinking, Adaptability & Problem-Solving: Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems.
Time Management & Organization: Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity.
Teamwork & Positive Attitude: Foster a collaborative environment where team members feel supported, practicing active listening, motiv...

Maidenhead, United Kingdom

On site

03-03-2025

A.P. Moller - Maersk

About the Company

Listed Jobs