Senior Cyber Engineer Security Logging & Data Platforms

The Senior Cyber Engineer - Security Logging & Data Platforms is responsible for the hands-on engineering operation and continuous improvement of the organisations end-to-end security logging and telemetry capability.
The role works across the complete data pipeline from collection at source through transport processing optimisation routing and storage to SIEM and other authorised security consumers. The engineer ensures telemetry is reliable scalable secure cost-efficient and usable for detection investigation threat hunting and operational decision-making.
This is primarily a technical engineering role. The postholder will also act as a key technical contributor to platform strategy roadmap lifecycle capacity cost and vendor discussions. The role does not carry formal people-management accountability but the postholder will be expected to provide technical leadership mentor colleagues and lead complex engineering activity when required.
The position supports a critical production capability and includes participation in the teams standby/on-call rota.

Design build operate and troubleshoot security telemetry pipelines from source systems through collection and processing platforms to storage SIEM and downstream consumers.

Engineer appropriate collection patterns for cloud SaaS on-premises network endpoint and application sources using technologies such as APIs syslog/CEF JSON Event Hubs Windows Event Collection and agent-based collection.

Own complex onboarding and integration work end to end including requirements design build testing production deployment validation documentation and transition into support.

Diagnose failures across distributed pipelines and coordinate recovery across internal teams platform providers and technology vendors.

Ensure pipeline designs meet security availability performance scalability and supportability requirements.

Provide hands-on engineering across Stream Edge and Search including routes pipelines functions packs event breaking worker groups fleet management lookups and search use cases.

Maintain platform health through monitoring patching upgrades vulnerability remediation capacity management configuration control and performance tuning.

Develop reusable patterns and automation that make onboarding routing and operational support faster safer and more consistent.

Optimise data volumes and processing to improve platform efficiency and manage ingestion storage and licensing costs without compromising agreed security outcomes.

Support the controlled extension of Cribl capabilities to suitable data and observability use cases beyond traditional SIEM ingestion.

Engineer and support integrations into SIEM and other approved destinations including long-term storage and search platforms.

Monitor source dataset and destination health and resolve issues affecting data availability completeness timeliness or usability.

Work with SOC RADAR detection engineering threat hunting and incident response stakeholders to translate security use cases into clear telemetry requirements.

Validate that onboarded data supports intended detection investigation and hunting outcomes before declaring delivery complete.

Maintain clear accountability boundaries: enable high-quality security data and platform capability while partnering with the relevant teams that own detection content and operational response.

Apply and improve standards for parsing normalisation schema alignment enrichment filtering metadata routing and data validation.

Ensure data is not merely ingested but is understandable trustworthy and actionable for its intended consumers.

Define quality checks and acceptance criteria for new and changed sources including completeness field quality timestamp handling duplication latency and routing accuracy.

Create and maintain source ownership design decisions dependencies support models and known limitations.

Use customer feedback operational evidence and platform metrics to improve the quality and value of security data products.

Operate the logging and SIEM pipeline as a critical production capability including health monitoring incident response problem management root-cause analysis and service restoration.

Plan and execute production changes upgrades and releases in line with change-control requirements and with minimal disruption to dependent services.

Develop and maintain dashboards alerts runbooks troubleshooting guides recovery procedures and support documentation.

Contribute to resilience continuity and recovery planning and test that critical operational procedures work in practice.

Participate in the standby/on-call rota and support major incidents or high-priority operational activity when required.

Maintain clear operational metrics covering platform health ingestion failures source coverage backlog change success patching capacity data quality cost and risk.

Act as a key technical contributor to the strategy roadmap and architectural evolution of the security logging data pipeline and SIEM capability.

Provide engineering input into lifecycle capacity licensing cost forecasting technical debt supportability and investment decisions.

Evaluate new features integration patterns and technologies through structured technical assessment and proof of value.

Work directly with strategic vendors and service partners to resolve technical issues improve platform outcomes and influence product direction where appropriate.

Identify operational or architectural risks early and provide clear options recommendations and escalation paths to leadership.

Provide technical leadership without relying on formal line-management authority.

Mentor engineers review designs and implementations and help colleagues build confidence in platform engineering troubleshooting and operational practices.

Lead complex engineering investigations and coordinate technical activity during high-impact changes or incidents.

Promote shared ownership by establishing primary and secondary coverage for critical platform areas and reducing reliance on individual experts.

Create reusable documentation patterns and learning material so that successful solutions can be repeated consistently.

Communicate progress risks dependencies and outcomes clearly to technical and non-technical stakeholders.

Maersk is committed to a diverse and inclusive workplace and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race colour gender sex age religion creed national origin ancestry citizenship marital status sexual orientation physical or mental disability medical condition pregnancy or parental leave veteran status gender identity genetic information or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website apply for a position or to perform a job please contact us by emailing .