Staff Cyber Defense Engineer (SOC Lead) – Automation & AI

INTEC CME India Pvt Ltd; Bengaluru; On-site; INR 900,000 - 1,300,000; Full time

Job summary

CME Group in Bengaluru is seeking a visionary Lead Cyber Defense Monitoring Engineer to drive an AI-driven SOC. This hands-on leadership role blends engineering, security operations, and automation to reduce MTTD/MTTR, while shaping playbooks, automation scripts, and analytics.

You will mentor engineers, coordinate incident response, and pioneer LLM/data science integrations to strengthen enterprise protections.

Qualifications

• 7+ years in SOC/IR or security engineering roles.
• 2+ years in a supervisory or team-lead capacity.
• Strong ML concepts and data pipelines for security analytics.

Responsibilities

• Lead automation, AI and agentic SOC strategy and oversee CI/CD with DaC.
• Act as Incident Commander for major security events and guide detections.

Skills

SOC operations

Incident response

Leadership

Machine learning in cybersecurity

LLM orchestration

Data pipelines

MITRE ATT&CK

Education

BA/BS in Engineering or CS

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Job description

We are seeking a visionary Lead Cyber Defense Monitoring Engineer to direct our transition toward an AI-driven, agentic Security Operations Center (SOC). Unlike a traditional analyst or leadership role, this position requires a hands-on engineering mindset. In addition to overseeing daily SOC operations, you will actively look for opportunities to improve processes, architect and govern complex automation scripts, and lead the team in the development of automated playbooks. This role is the cornerstone for bridging core cyber defense operations with modern automation, machine learning, and engineering practices. As the Lead, you will define the automation roadmap, mentor senior engineers, serve as the Incident Commander during critical breaches, and pioneer the integration of Large Language Models (LLMs) and data science into our overarching defense strategy.

Key Responsibilities

• Automation, AI & Agentic SOC Strategy Translate the organization's strategic roadmap into actionable team goals. Ensure the team successfully deploys and scales AI-driven autonomous agents capable of performing triage, context gathering, and initial containment. Oversee the team's automation deliverables and SOAR integrations. Enforce coding standards, manage the peer-review pipeline for Python/REST API scripts, and ensure strict team adherence to Detection as Code (DaC) CI/CD pipelines. Direct the daily work of the engineering and analyst teams. Foster an engineering-first culture by ensuring staff receive the training and guidance needed to upskill in prompt engineering, script writing, and modern data practices. Supervise the team's application of data analytics and machine learning models to enterprise security datasets, ensuring their work results in high-fidelity alerting and a reduction in false positives. Hold the team accountable for key performance indicators (KPIs) related to automation efficacy. Ensure the team consistently optimizes SOC workflows to drastically reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
• Consolidated Cyber Defense Leadership Serve as the Incident Commander for major security events and high-severity breaches, orchestrating the response efforts of your team and coordinating with executive leadership. Supervise overarching threat hunting and intelligence programs. Ensure the team actively takes novel threats and APT behaviors discovered during hunts and operationalizes them into automated detections. Manage the holistic health and integration of the core security stack (SIEM, EDR, NDR, Cloud Security), ensuring your team maintains maximum ROI and data quality for the AI engines.

Qualifications & Skills

• 7+ years of progressive experience in a SOC, Incident Response, or Security Engineering environment, with 2+ years of direct supervisory or team lead experience overseeing technical staff.
• Strong conceptual understanding of applied machine learning in cybersecurity, LLM orchestration frameworks, and data pipelines to effectively manage and evaluate the engineering team's output.
• Expert-level knowledge of adversary tactics (MITRE ATT&CK), network architecture, and forensic analysis, coupled with proven experience leading technical incident response under pressure.
• Strong familiarity with the capabilities and governance of enterprise SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines) to effectively guide team deliverables.
• BA/BS in Engineering, Computer Science, or Information Security (non-tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications)
• Advanced security, engineering, or leadership certifications such as GSE, GCIA, GCFA, CISSP, AWS Certified Security / Machine Learning, or SANS SEC573/SEC540/MGT512.

CME Group: Where Futures are Made

CME Group is the world's leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it - all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we're looking for more. At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued. As an equal-opportunity employer, we consider all potential employees without regard to any protected characteristic.

E-Verify Notice

For U.S. employment, CME Group is legally required to validate a new hire’s employment eligibility by having them complete an Employment Eligibility Verification (Form I-9) companied with legally acceptable proof of identity and work authorization (as listed on the Form I-9). CME Group uses E-Verify, which is an online system operated by the U.S. Department of Homeland Security in partnership with the Social Security Administration to verify employment eligibility and validate social security numbers. Through participation in the E-Verify program, information entered on Form I-9 will be provided and compared to information available at both of these agencies. See posters below for more details. E-Verify Notice E-Verify Notice Español U.S. Right to Work Notice U.S. Right to Work Notice Español