Staff Cyber Defense Engineer (SOC Lead) – Automation & AI

CME Group; Bengaluru; Remote; INR 4,000,000 - 7,000,000; Full time

Job summary

CME Group is seeking a visionary Lead Cyber Defense Monitoring Engineer to steer our transition toward an AI-driven, agentic SOC. The role blends hands-on engineering with leadership, guiding automation, playbooks, and integration of ML and LLMs into defense strategies.

You will define automation roadmaps, mentor engineers, and serve as Incident Commander during critical breaches, advancing the security stack and data-driven defense capabilities.

Qualifications

• 7+ years in SOC, IR, or security engineering
• 2+ years leading technical staff
• Strong ML concepts in cybersecurity and data pipelines
• Experience with DOA/automation and playbooks
• Knowledge of MITRE ATT&CK and incident response under pressure
• Leadership certifications or advanced security credentials are a plus

Responsibilities

• Define automation roadmap and AI-driven SOC strategy.
• Oversee automation deliverables, code reviews, and DaC CI/CD pipelines.
• Mentor senior engineers and lead incident command during breaches.
• Apply ML models to security data to reduce false positives.
• Maintain health of core security stack (SIEM, EDR, NDR, cloud security).

Skills

SOC leadership

Incident response

Prompt engineering

ML in cybersecurity

LLM orchestration

Data pipelines

Threat intelligence

Cyber defense automation

Education

BA/BS in Engineering or CS

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Job description

We are seeking a visionary Lead Cyber Defense Monitoring Engineer to direct our transition toward an AI-driven, agentic Security Operations Center (SOC). Unlike a traditional analyst or leadership role, this position requires a hands‑on engineering mindset. In addition to overseeing daily SOC operations, you will actively look for opportunities to improve processes, architect and govern complex automation scripts, and lead the team in the development of automated playbooks. This role is the cornerstone for bridging core cyber defense operations with modern automation, machine learning, and engineering practices.

As the Lead, you will define the automation roadmap, mentor senior engineers, serve as the Incident Commander during critical breaches, and pioneer the integration of Large Language Models (LLMs) and data science into our overarching defense strategy.

Key Responsibilities

Automation, AI & Agentic SOC Strategy

• Translate the organization's strategic roadmap into actionable team goals. Ensure the team successfully deploys and scales AI-driven autonomous agents capable of performing triage, context gathering, and initial containment.
• Oversee the team's automation deliverables and SOAR integrations. Enforce coding standards, manage the peer-review pipeline for Python/REST API scripts, and ensure strict team adherence to Detection as Code (DaC) CI/CD pipelines.

• Direct the daily work of the engineering and analyst teams. Foster an engineering-first culture by ensuring staff receive the training and guidance needed to upskill in prompt engineering, script writing, and modern data practices.
• Supervise the team's application of data analytics and machine learning models to enterprise security datasets, ensuring their work results in high-fidelity alerting and a reduction in false positives.
• Hold the team accountable for key performance indicators (KPIs) related to automation efficacy. Ensure the team consistently optimizes SOC workflows to drastically reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

Consolidated Cyber Defense Leadership

• Serve as the Incident Commander for major security events and high‑severity breaches, orchestrating the response efforts of your team and coordinating with executive leadership.
• Supervise overarching threat hunting and intelligence programs. Ensure the team actively takes novel threats and APT behaviors discovered during hunts and operationalizes them into automated detections.
• Manage the holistic health and integration of the core security stack (SIEM, EDR, NDR, Cloud Security), ensuring your team maintains maximum ROI and data quality for the AI engines.

Qualifications & Skills

• 7+ years of progressive experience in a SOC, Incident Response, or Security Engineering environment, with 2+ years of direct supervisory or team lead experience overseeing technical staff.
• Strong conceptual understanding of applied machine learning in cybersecurity, LLM orchestration frameworks, and data pipelines to effectively manage and evaluate the engineering team's output.
• Expert-level knowledge of adversary tactics (MITRE ATT&CK), network architecture, and forensic analysis, coupled with proven experience leading technical incident response under pressure.
• Strong familiarity with the capabilities and governance of enterprise SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines) to effectively guide team deliverables.
• BA/BS in Engineering, Computer Science, or Information Security (non-tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications)
• Advanced security, engineering, or leadership certifications such as GSE, GCIA, GCFA, CISSP, AWS Certified Security / Machine Learning, or SANS SEC573/SEC540/MGT512.

CME Group: Where Futures are Made

CME Group is the world’s leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it – all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we’re looking for more.

At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued. As an equal-opportunity employer, we consider all potential employees without regard to any protected characteristic.