Senior Cyber Engineer - Security Logging & Data Platforms

The role works across the complete data pipeline, from collection at source through transport, processing, optimisation, routing and storage to SIEM and other authorised security consumers. The engineer ensures telemetry is reliable, scalable, secure, cost-efficient and usable for detection, investigation, threat hunting and operational decision-making.

This is primarily a technical engineering role. The postholder will also act as a key technical contributor to platform strategy, roadmap, lifecycle, capacity, cost and vendor discussions. The role does not carry formal people-management accountability, but the postholder will be expected to provide technical leadership, mentor colleagues and lead complex engineering activity when required.

The position supports a critical production capability and includes participation in the team's standby/on-call rota.

Key responsibilities

1. End-to-end security telemetry engineering

·Design, build, operate and troubleshoot security telemetry pipelines from source systems through collection and processing platforms to storage, SIEM and downstream consumers.

·Engineer appropriate collection patterns for cloud, SaaS, on-premises, network, endpoint and application sources using technologies such as APIs, syslog/CEF, JSON, Event Hubs, Windows Event Collection and agent-based collection.

·Own complex onboarding and integration work end to end, including requirements, design, build, testing, production deployment, validation, documentation and transition into support.

·Diagnose failures across distributed pipelines and coordinate recovery across internal teams, platform providers and technology vendors.

·Ensure pipeline designs meet security, availability, performance, scalability and supportability requirements.

2. Logging platform engineering

·Provide hands-on engineering across Stream, Edge and Search, including routes, pipelines, functions, packs, event breaking, worker groups, fleet management, lookups and search use cases.

·Maintain platform health through monitoring, patching, upgrades, vulnerability remediation, capacity management, configuration control and performance tuning.

·Develop reusable patterns and automation that make onboarding, routing and operational support faster, safer and more consistent.

·Optimise data volumes and processing to improve platform efficiency and manage ingestion, storage and licensing costs without compromising agreed security outcomes.

·Support the controlled extension of Cribl capabilities to suitable data and observability use cases beyond traditional SIEM ingestion.

3. SIEM and security consumer enablement

·Engineer and support integrations into SIEM and other approved destinations, including long-term storage and search platforms.

·Monitor source, dataset and destination health and resolve issues affecting data availability, completeness, timeliness or usability.

·Work with SOC, RADAR, detection engineering, threat hunting and incident response stakeholders to translate security use cases into clear telemetry requirements.

·Validate that onboarded data supports intended detection, investigation and hunting outcomes before declaring delivery complete.

·Maintain clear accountability boundaries: enable high-quality security data and platform capability while partnering with the relevant teams that own detection content and operational response.

4. Data quality and data-as-a-product

·Apply and improve standards for parsing, normalisation, schema alignment, enrichment, filtering, metadata, routing and data validation.

·Ensure data is not merely ingested, but is understandable, trustworthy and actionable for its intended consumers.

·Define quality checks and acceptance criteria for new and changed sources, including completeness, field quality, timestamp handling, duplication, latency and routing accuracy.

·Create and maintain source ownership, design decisions, dependencies, support models and known limitations.

·Use customer feedback, operational evidence and platform metrics to improve the quality and value of security data products.

5. Operational engineering and service reliability

·Operate the logging and SIEM pipeline as a critical production capability, including health monitoring, incident response, problem management, root-cause analysis and service restoration.

·Plan and execute production changes, upgrades and releases in line with change-control requirements and with minimal disruption to dependent services.

·Develop and maintain dashboards, alerts, runbooks, troubleshooting guides, recovery procedures and support documentation.

·Contribute to resilience, continuity and recovery planning, and test that critical operational procedures work in practice.

·Participate in the standby/on-call rota and support major incidents or high-priority operational activity when required.

·Maintain clear operational metrics covering platform health, ingestion failures, source coverage, backlog, change success, patching, capacity, data quality, cost and risk.

6. Platform strategy, lifecycle and vendor contribution

·Act as a key technical contributor to the strategy, roadmap and architectural evolution of the security logging, data pipeline and SIEM capability.

·Provide engineering input into lifecycle, capacity, licensing, cost forecasting, technical debt, supportability and investment decisions.

·Evaluate new features, integration patterns and technologies through structured technical assessment and proof of value.

·Work directly with strategic vendors and service partners to resolve technical issues, improve platform outcomes and influence product direction where appropriate.

·Identify operational or architectural risks early and provide clear options, recommendations and escalation paths to leadership.

7. Technical leadership and capability uplift

·Provide technical leadership without relying on formal line-management authority.

·Mentor engineers, review designs and implementations, and help colleagues build confidence in platform engineering, troubleshooting and operational practices.

·Lead complex engineering investigations and coordinate technical activity during high-impact changes or incidents.

·Promote shared ownership by establishing primary and secondary coverage for critical platform areas and reducing reliance on individual experts.

·Create reusable documentation, patterns and learning material so that successful solutions can be repeated consistently.

·Communicate progress, risks, dependencies and outcomes clearly to technical and non-technical stakeholders.

Maersk is committed to a diverse and inclusive workplace, and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race, colour, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability, medical condition, pregnancy or parental leave, veteran status, gender identity, genetic information, or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website, apply for a position, or to perform a job, please contact us by emailing [email protected].