Senior Cyber Engineer - Governance

Security Engineering Depth
Control and Architecture Assessment
Technical Assurance and Evidence
Automation, Data and Integration
Independent Judgement and Communication
Collaboration and Influence

Senior Cyber Engineer – Governance

 

A.P. Moller – Maersk is the global leader in integrated container logistics.  The business operates in 130 countries and employs c. 100,000 staff.  Our company purpose is improving life for all by integrating the world.

 

We Offer 

Maersk has established industry-leading capability in cyber resilience, even when compared to leaders within Technology and Financial Services institutions. Joining Maersk is joining a winning team with great opportunities for professional development within a global organisation.

Maersk is transforming Cyber Assurance from periodic assessments into a continuous, adaptive assurance capability that provides trusted evidence on whether critical cyber controls are working. As Senior Cyber Engineer – Governance, you will be the technical anchor for this transformation.

You will work across cloud, identity, network, platforms, applications and operational technology to develop scalable assurance techniques, connect evidence from authoritative sources and automate evidence-based insight generation to inform near real-time conclusions that leaders and control owners can act on across a constantly evolving technology landscape.

You will help define how Cyber Assurance is engineered at Maersk, from developing machine-testable control approaches and trusted evidence models to shaping the Assurance Engine. You will build new capabilities that combine security engineering, data, automation and assurance at global scale.

This is an engineering role with a different vantage point. You will work across the control environment to validate what is effective, expose blind spots and shape how assurance is engineered at enterprise scale.

This is a rare opportunity to influence how one of the world's largest logistics organisations understands, validates and continuously improves cyber control effectiveness across a global technology estate.

 

Global integrated logistics. Secured by Maersk. 

What do we do?  We provide the tools, expertise and governance to manage Maersk's cyber risk.  Anyone can do these things.  But can our competitors do them with the same level of daily excellence as Maersk?  

 

How do we do it?  We proactively mitigate today’s risks, issues and events and tomorrow’s emerging threats.  This is how we differentiate ourselves from our competitors – our maturity in managing risks, issues and events is hard to beat.  

 

Why do we do it?  We believe in defending global integrated logistics in an increasingly hostile cyber world.  This strong sense of purpose is what motivates us.  It is why we insourced cyber security.  Security is a passion, not a transaction to be outsourced to others. 

 

Why this job matters? 

We employ over 280 full-time Maersk staff in our Cyber Security organisation globally and use industry-leading cyber tooling to protect Maersk and its 100,000 employees spread across 130 countries.  We continually invest in our automated defences, the skills and knowledge of our people, and process improvement, spending $70-80M annually on cyber security.  In a typical week, we see 177,000 cyber events.  Of these, one every 3 minutes, 24/7, is actively testing our defences.  AI and automation deal with most events, but on average our in-house human defenders process 450-600 events a week.  About 2 incidents a day impact one endpoint or more, which Cyber Security and Technology colleagues contain, clear and return to operation so business can carry on without wider interruption from any contagion.  This is what resilience looks like – the ability of a company to continue operating through relentless attacks, some of which inevitably breach our outer defences and have to be dealt inside our technology eco-system.  But all of this depends on maintaining a good security posture by understanding where we carry risk.  This is where you come in – providing the evidence to inform company decision-making and to reassure our customers that they can trust us.  The role will provide independent, evidence-based challenge to cyber risk ratings, audit conclusions and control-effectiveness assertions where evidence is insufficient, escalating material unresolved concerns through the appropriate Cyber Assurance governance channels.

 

What I’ll be doing – your accountabilities

Engineer Scalable Assurance

• Act as the technical anchor for Maersk’s Continuous Assurance transformation, helping establish the capabilities, methods and technology required to deliver assurance at enterprise scale.

·       Translate control objectives and intended designs into repeatable assurance procedures, using machine-testable approaches where suitable and well-defined human testing where they are not. 

·       Design reusable approaches for collecting, validating and correlating evidence from authoritative source systems. 

·       Help develop the Assurance Engine by combining trusted evidence, automation, analytics and assurance judgement into scalable capabilities. 

·       Identify where automation and AI can improve coverage, consistency and insight without weakening evidence quality or human accountability. 

 

Validate Controls

·       Independently assess whether controls are appropriately designed, implemented and operating effectively. 

·       Perform technical validation across complex environments and challenge control assertions where evidence is incomplete or insufficient. 

• Identify systemic weaknesses, dependencies, coverage gaps and blind spots, performing root-cause analysis where required to understand why controls are failing or underperforming, then translate findings into clear assurance conclusions and targeted actions.

 

Enable the Three Assurance Pillars

·       Continuous control assurance: create repeatable ways to assess control effectiveness, confidence, coverage and blind spots. 

·       Threat-led assurance: test whether controls work together across realistic threat scenarios and control chains. 

·       Customer trust and certification: provide technical expertise and reusable trusted evidence for certifications, audits and customer assurance.

 

Influence through Evidence

·       Partner with Cyber Operations, Architecture, Risk, Technology, Data, AI and control owners to obtain reliable facts while retaining independent assurance judgement. 

• Communicate complex technical findings, root causes and control effectiveness outcomes in language that supports risk, investment and remediation decisions.

·       Provide credible, balanced challenge to technical and non-technical stakeholders, including leadership, customers, auditors and external assessors.

 

 

Ideal Candidate – Knowledge, Skills & Abilities

Security Engineering Depth 

Recognised expertise in one or more areas such as cloud security, identity and access management, network security, applications and APIs, infrastructure and platforms, detection engineering, data protection, cryptography or operational technology. 

Control and Architecture Assessment 

Ability to connect a control objective to intended design, technical implementation and operational effectiveness, and recognise dependencies or weaknesses across the wider control chain. 

Technical Assurance and Evidence 

Experience validating controls through configuration review, architecture review, technical testing, source-system data or other authoritative evidence. 

Automation, Data and Integration 

Ability to shape practical automation, API or data-integration approaches that make assurance more repeatable and scalable. Hands-on expertise in every tool is not required, but engineering credibility is. 

Independent Judgement and Communication 

Confidence to challenge constructively, explain the limits of available evidence and turn complex findings into clear outcomes and actionable insight. 

Collaboration and Influence 

Ability to work across operations, architecture, engineering, risk, data and business teams, building trust while maintaining the independence of the assurance conclusion. 

Useful Knowledge and Experience 

• Common security control frameworks and assurance standards, such as NIST CSF, ISO 27001/27002, SOC 2 and Zero Trust principles. 
• Modern enterprise environments spanning cloud, identity, networks, applications, APIs, infrastructure, data platforms and operational technology. 
• Assurance, audit, penetration testing, control testing, security architecture review or technical risk assessment. 
• Evidence models, data quality, lineage, analytics, automation or AI-assisted analysis in a security context.

 

 

Maersk is committed to a diverse and inclusive workplace, and we embrace different styles of thinking. Maersk is an equal opportunities employer and welcomes applicants without regard to race, colour, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability, medical condition, pregnancy or parental leave, veteran status, gender identity, genetic information, or any other characteristic protected by applicable law. We will consider qualified applicants with criminal histories in a manner consistent with all legal requirements.

 

We are happy to support your need for any adjustments during the application and hiring process. If you need special assistance or an accommodation to use our website, apply for a position, or to perform a job, please contact us by emailing  [email protected].