> Markdown version of [/jobs/ext/1444908-cyber-technical-lead](https://www.wearedevelopers.com/jobs/ext/1444908-cyber-technical-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Technical Lead - **Company:** Maersk - **Location:** Maidenhead, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Amazon Web Services, Proxy Servers, Apple Mac Systems, Application Testing, Assembly Language, Automation of Tests, Microsoft Azure, Bash Shell, Burp Suite, Cloud Computing, Cloud Computing Security, Cyber Security, Databases, Query Languages, Software Debugging, Linux, Event Logging, Github, Design of User Interfaces, Human-Computer Interaction, Networking Hardware, Intrusion Detection Systems, Python (Programming Language), Log Analysis, Nmap, Windows PowerShell, Program Analysis, Red Team (Cyber Security), Kusto Query Language, Reverse Engineering, System Programming, Wireshark, Web Applications, Jupyter Notebook, Network Routers, Scripting, Google Cloud, Load Balancing, In-Plane Switching (IPS), Software Security, Mitre Att&ck, AWS Lambda, Metasploit, Cybercrime, Cortex XSOAR Platform, Malware Detection, Operating System Security - **Published:** July 26, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=32a77c6c1523c89a ## About the Role Technical Skills and Knowledge: * Incident Response: + Ability to conduct thorough host and network investigations to analyze and mitigate malicious activities using tools like Sysinternals, Wireshark, and TCPDump.Strong log analysis skills across various platforms, including OS, web applications, network devices, and security tools (e.g., Anti-malware, EDR, IPS, IDS, WAF, email protection, DLP, routers, load balancers, and proxies). * Cloud Security Knowledge: Strong knowledge of cloud technologies and security (e.g., AWS, Azure, Alibaba, Google Cloud), with skills in performing investigations, log analysis, and incident response. + OT/IOT: Understanding of OT environment and security is desirable but not essential. o OS Security Knowledge: # Deep understanding of operating systems, OS-level exploits, and cybersecurity for Windows and Linux, including OS hardening techniques.Ability to locate, analyze, and interpret forensic artifacts in Windows and Linux during investigations (e.g., registry, event logs, browser history, memory dumps) using tools like Volatility and FTK. o Application Security Knowledge: # Familiarity with application-level attacks, prevention methods, hardening configurations, and log analysis for applications like web applications and databases. # Proficiency in scripting languages (e.g., Bash, Python, PowerShell) for automation and process improvement.Strong understanding of malware behavior, persistence mechanisms, and the ability to perform static and dynamic analysis, including sandbox report interpretation and reverse engineering. o Purple Teaming: # Knowledge of various cyber attacks, simulations, and identification methods.Ability to lead purple teaming activities, developing scenarios and engaging in both blue and red team activities. Proficiency with offensive tools like Metasploit, Nmap, Cobalt Strike, Hydra, John the Ripper, Burp Suite, Mimikatz, Bloodhound, and others. o Threat Hunting: # Experience with advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) mapped to the cyber kill chain.Create hypotheses for proactive threat hunts and utilize tools like MISP and Jupyter Notebook for effective hunts. o Process Development: # Develop playbooks and templates for incident management. # Identify and address gaps in current processes, collaborate with other teams, and build streamlined cross-departmental processes. o Automation Development: # Identify repetitive tasks and develop automation ideas. # Collaborate with automation teams to build capabilities using platforms like CrowdStrike Fusion, AWS Lambda, Azure Logic Apps, XSOAR, and Python scripts. o Languages: # Query Languages: Proficiency in query languages like KQL and Logscale for investigations and log analysis. # Scripting Languages: Proven experience in scripting. o Managing Relationships: Develop and maintain key relationships with forensics, security operations governance, cyber defence engineering, risk and compliance, IT, and other business units. Soft Skills: # Operations Management & Issue Resolution : Ensure smooth operations and continuity by proactively identifying and addressing operational issues, team dynamics, and inefficiencies in ticket handling. # Report Writing: Ability to write reports that convey highly technical information whilst remaining accessible to a non-technical audience (including at executive level). # Communication: Exhibit excellent written/verbal communication skills, with the ability to develop documentation and explain technical details in a concise manner. # Mentorship : training and guiding junior team members, promoting a culture of knowledge sharing and continuous learning. # Critical Thinking, Adaptability & Problem-Solving : Demonstrate strong analytical skills and flexibility to adapt to changing priorities and emerging cybersecurity threats while effectively solving problems. # Time Management & Organization : Prioritize tasks efficiently and maintain organized documentation and processes to enhance team productivity. # Teamwork & Positive Attitude : Foster a collaborative environment where team members feel supported, practicing active listening, motivating the team, and maintaining a positive demeanor, especially in high-pressure situations., # 7+ years of experience in cybersecurity, with a minimum of 3 years in a SOC or incident response leadership role. # Relevant advanced certifications (e.g., GCIA, GSEC, CEH, GCDA, GCIH, GCFA, OSCP) are highly desirable but not essential.Proven self-learning abilities demonstrated through research, GitHub projects, bug hunting, active participation in public cybersecurity forums, or high scores on platforms like HTB, Immersive Labs, TryHackMe, and SANS CTF. Bonus Points: # Knowledge of reverse engineering tools (disassemblers, decompilers, debuggers) and processes (unpacking malware, reconstructing code logic, etc). # Low-level programming experience for example, C, Python, Go, and/or other languages desirable # Assembly language knowledge is a plus. # Experience in User-Interface/User-Experience (UI/UX) design and development. # Development and deployment of dockerized applications. # 3 years of experience in static and dynamic malicious code reverse engineering. # Experience with multiple platforms (Linux, MacOS, mobile, etc.) is a plus. # A background in intelligence is a plus. ## Description Incident Response and Leadership * Act as the principal technical point of contact for all cyber security matters, providing expertise to senior engineers and analysts. * Act as the principal escalation point for the most complex and high-risk incidents, driving resolution with precision and technical depth. * Leading the cyber Incident Response process from a technical perspective and effective management of high-priority cyber incidents. * Supporting the Incident Manager in driving post-incident reviewsCollaborate with global stakeholders in technical conversations, to align response efforts and communicate effectively across technical audiences during incidents. Continuous Improvement * Identify gaps and continuously improve detection and response capabilities by creating and fine-tuning use cases, developing automation and documenting processes and playbooks. * Identifying lessons learned to improve future incident response and detection strategies. * Contribute to development of detection mechanisms for sophisticated adversarial techniques based on the MITRE ATT&CK framework. Purple Teaming and Advanced Testing * Lead purple teaming exercises to integrate offensive and defensive strategies, driving measurable improvements in detection and response. * Architect and execute advanced attack simulations, employing state-of-the-art offensive tools and TTPs to test organizational resilience. * Develop scenarios and artifacts that mimic real-world adversary groups for simulated testing. Leadership and Team Development * Mentor and coach a multidisciplinary team of analysts and investigators, from a technical perspective. * Lead CTF exercises or other similar initiatives to maintain continuously development of team skills. * Champion new technologies and run coaching sessions to cross skill team members. * Assist the leadership team with quality control and feedback reviews. * Develop training materials and deliver training as part of the team's continuous development.Conduct and participate in Cyber Incident Response exercises. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)