Cyber Incident Manager

Maersk Company; Maidenhead; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

A leading logistics firm in Maidenhead seeks an Incident Management lead for its innovative Cyber Team. The role involves leading incident response efforts, collaborating with teams, and enhancing detection strategies while promoting continuous learning. Ideal candidates bring over 5 years in incident management, strong leadership skills, and a passion for driving change in cybersecurity. Flexible working arrangements and a collaborative culture are part of the job.

Benefits

Flexible working arrangement

Collaborative culture

Work-life balance

Qualifications

• 5+ years of experience in an Incident Management role, with 3+ years in SOC or incident response leadership.
• Proven self-learning abilities in cybersecurity through various platforms.
• Experience with multiple platforms (Linux, MacOS, mobile) is a plus.

Responsibilities

• Lead incident management activities for high priority cyber-security incidents.
• Coordinate resources to develop and execute response plans effectively.
• Contribute to and participate in cyber-security incident readiness activities.

Skills

Leadership

Technical communication

Critical thinking

Problem-solving

Time management

Education

Relevant advanced certifications (e.g., GCIA, GSEC, CEH)

Tools

Docker

Scripting languages (Bash, Python, PowerShell)

Job description

Overview

Join Maersk’s groundbreaking Cyber Team: Redefining Incident Management & Response

Imagine a career where you're not just responding to security incidents—you’re revolutionising how it’s done. At Maersk, one of the world’s largest and most respected logistics and shipping companies, our Cyber team is pioneering a whole new approach to incident response. This isn’t your typical SOC/CERT role: our combined fire team is built on cutting-edge research and designed to drive change, resilience, and agility in ways the industry has never seen before.

Here, you’ll be part of a dynamic team that defends, adapts, and innovates with freedom and purpose. You won’t just work on Incident Management; you’ll help improve how it’s done. Dive into purple teaming, create and refine world-class detections, shape change projects, and push the boundaries of what’s possible—all during the workday with no overnight shifts. Plus, we champion continuous learning and growth through Capture the Flag (CTF) exercises and direct opportunities to bring your ideas to life.

Are you ready to be part of something transformational at Maersk and join a team that’s setting a new standard in cybersecurity?

Responsibilities

• Lead incident management activities in response to all high priority cyber-security incidents, with the ability to remain calm and focused during crisis situations.
• Ability to manage conflicting priorities and multiple tasks in a high-pressure environment.
• Strong leadership skills with the ability to motivate and manage response teams during high-pressure situations.
• Coordinate resources across the organisation to develop and execute response plans that ensure cyber-security incidents are managed effectively and efficiently and limit or mitigate business impact.
• Communicate effectively with internal stakeholders, including senior leadership with the ability to provide rapid and concise summaries of complex situations.
• Deliver and coordinate Post Incident activities which include producing detailed incident reports and conducting Post Incident Reviews.
• Contribute to and participate in cyber-security incident readiness activities which can include simulations and tabletop exercises.

Continuous Improvement

• Identify gaps and continuously improve detection and response capabilities by creating and fine-tuning use cases, developing automation and documenting processes and playbooks.
• Identify lessons learned to improve future incident response and detection strategies.
• Contribute to development of detection mechanisms for sophisticated adversarial techniques based on the MITRE ATT&CK framework.

Purple Teaming and Advanced Testing

• Support the planning and response of purple teaming activities.
• Develop scenarios and artifacts that mimic real-world adversary groups for simulated testing.

Leadership and Team Development

• Mentor and coach a multidisciplinary team of analysts and investigators, from a technical perspective.
• Contribute to CTF exercises or other similar initiatives to maintain continuous development of team skills.
• Champion new processes and run coaching sessions to cross-skill team members.
• Assist the leadership team with quality control and feedback reviews.
• Develop training materials and deliver training as part of the team’s continuous development.
• Conduct and lead in Cyber Incident Response exercises.

Soft Skills

• Operations Management & Issue Resolution: Ensure smooth operations and continuity by proactively identifying and addressing operational issues, team dynamics, and inefficiencies in ticket handling.
• Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level).
• Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner.
• Mentorship: training and guiding junior team members, promoting a culture of knowledge sharing and continuous learning.
• Critical Thinking, Adaptability & Problem-Solving: Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems.
• Time Management & Organization: Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity.
• Teamwork & Positive Attitude: Foster a collaborative environment where team members feel supported, practicing active listening, motivating the team, and maintaining a positive demeanour, especially in high-pressure situations.

Qualifications

• 5+ years of experience in an Incident Management role, with a minimum of 3 years in a SOC or incident response leadership role.
• Relevant advanced certifications (e.g., GCIA, GSEC, CEH, GCDA, GCIH, GCFA, OSCP) are highly desirable but not essential.
• Proven self-learning abilities demonstrated through research, GitHub projects, bug hunting, active participation in public cybersecurity forums, or high scores on platforms like HTB, Immersive Labs, TryHackMe, and SANS CTF.

Bonus Points

• Knowledge of reverse engineering tools (disassemblers, decompilers, debuggers) and processes (unpacking malware, reconstructing code logic, etc) is desirable.
• Some programming experience in languages such as C, Python, Go, or others is desirable.
• Assembly language knowledge is a plus but not essential.
• Development and deployment of dockerized applications is desirable but not essential.
• Experience with multiple platforms (Linux, MacOS, mobile, etc.) is a plus but not necessarily essential.
• A background in intelligence is a plus.
• Knowledge of scripting languages for automation and process improvement (e.g., Bash, Python, PowerShell) is desirable.

Company Benefits

• Flexible working arrangement: Remote working with occasional in-person team building activities
• Collaborative Culture: Experience a supportive and inclusive work environment that values teamwork and innovation. We believe in open communication and knowledge sharing, ensuring that every team member feels empowered and valued.
• Work-Life Balance: We understand the importance of maintaining a healthy work-life balance. Our flexible working arrangements and supportive policies enable you to excel in your role while enjoying your personal life.

Maersk is committed to a diverse and inclusive workplace, and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race, colour, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability, medical condition, pregnancy or parental leave, veteran status, gender identity, genetic information, or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website, apply for a position, or to perform a job, please contact us by emailing [e-mail].