Cyber Defense Analyst II

CME Group; Chicago (IL); On-site; USD 94,000 - 157,000; Full time

Benefits offered by this job

Equity program

401(k) retirement plan

Health coverage

Education reimbursement

Paid time off

Job summary

CME Group in Chicago seeks a Cyber Defense Analyst II to monitor, triage, and validate security threats while advancing automation and engineering practices within the SOC. You will develop scripts and Siem detections, bridging traditional monitoring with AI-augmented workflows to reduce manual toil and improve detection fidelity.

The role emphasizes hypothesis-driven threat hunting, strong analytical skills, and collaboration with Incident Response and engineering teams.

Qualifications

• 1–3 years of experience in a Level 1 SOC environment or related Information Security role.
• Proficient with Python, Rust, Java, or a related programming language, specifically for automating tasks, interacting with APIs, or processing data (JSON/XML).
• Working knowledge of network protocols, operating system internals (Windows/Linux/macOS), and adversary tactics mapped to the MITRE ATT&CK framework.
• Exposure to or hands-on experience using modern SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines) for alert enrichment and response.
• Familiarity with cloud environments (preferably GCP or AWS) and understanding of cloud-specific telemetry.
• Interest in modern engineering practices, including version control (Git) and basic CI/CD workflows.
• Willingness to learn and adapt to emerging AI capabilities, including using LLMs to assist in security investigations.

Responsibilities

• Perform analysis, triage, and validation of security events across network, host, identity, and cloud (GCP) telemetry to accurately identify malicious activity and filter out false positives.
• Ensure seamless handoffs to the Incident Response team or senior engineers by providing well-documented, contextualized, and enriched security alerts.
• Identify manual, repetitive monitoring tasks within the SOC and write scripts or develop SOAR playbooks to automate them.
• Contribute to our transition to Detection-as-Code (DaC) by assisting in the development, testing, and deployment of SIEM detection rules using version control (Git).
• Utilize and provide operational feedback on new AI-assisted workflows and agentic triage outputs to help engineering teams refine high-accuracy monitoring.
• Participate in hypothesis-driven threat hunts and help operationalize threat intelligence into automated detection mechanisms.
• Collaborate with peers to foster a culture of continuous learning, critical thinking, and automation within the SOC.
• Maintain and update detailed documentation of monitoring processes, playbook logic, and detection schemas within the Knowledge Management System.

Skills

SOC experience

Python

Rust

Java

MITRE ATT&CK

SOAR platforms

Cloud knowledge

CI/CD basics

Git

AI in security

Analytical mindset

Communication

Threat hunting

Education

BA/BS in Computer Science or related field

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Git

Job description

The Cyber Defense Analyst II position is responsible for monitoring, detecting, and validating security threats across our environment. As our Security Operations Center transitions toward an engineering and automation-first model, this role acts as an active contributor bridging traditional cyber defense monitoring and modern development practices. You will perform telemetry analysis and triage while dedicating time to identifying process bottlenecks and developing automation scripts to improve our workflow. This position is ideal for candidates with foundational security experience looking to evolve their career by applying an engineering mindset to everyday monitoring challenges, helping us eliminate manual toil, improve detection fidelity, and support the deployment of AI-augmented triage workflows.

Position Responsibilities

• Perform analysis, triage, and validation of security events across network, host, identity, and cloud (GCP) telemetry to accurately identify malicious activity and filter out false positives.
• Ensure seamless handoffs to the Incident Response team or senior engineers by providing well-documented, contextualized, and enriched security alerts.
• Identify manual, repetitive monitoring tasks within the SOC and write scripts or develop SOAR playbooks to automate them.
• Contribute to our transition to Detection-as-Code (DaC) by assisting in the development, testing, and deployment of SIEM detection rules using version control (Git).
• Utilize and provide operational feedback on new AI-assisted workflows and agentic triage outputs to help engineering teams refine high-accuracy monitoring.
• Participate in hypothesis-driven threat hunts and help operationalize threat intelligence into automated detection mechanisms.
• Collaborate with peers to foster a culture of continuous learning, critical thinking, and automation within the SOC.
• Maintain and update detailed documentation of monitoring processes, playbook logic, and detection schemas within the Knowledge Management System.

Experience & Technical Skills

• 1–3 years of experience in a Level 1 SOC environment or related Information Security role.
• Proficient with Python, Rust, Java, or a related programming language, specifically for automating tasks, interacting with APIs, or processing data (JSON/XML).
• Working knowledge of network protocols, operating system internals (Windows/Linux/macOS), and adversary tactics mapped to the MITRE ATT&CK framework.
• Exposure to or hands‑on experience using modern SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines) for alert enrichment and response.
• Familiarity with cloud environments (preferably GCP or AWS) and understanding of cloud‑specific telemetry.
• Interest in modern engineering practices, including version control (Git) and basic CI/CD workflows.
• Willingness to learn and adapt to emerging AI capabilities, including using LLMs to assist in security investigations.

Soft Skills & Competencies

• Strong analytical and problem-solving mindset; naturally curious about how things work and how to make them more efficient.
• Excellent communication skills, capable of translating telemetry and log data into clear, actionable summaries for Incident Response and engineering peers.
• Self‑motivated and able to balance active alert analysis with assigned automation and playbook development projects.
• Collaborative team player who enjoys bridging the gap between daily monitoring operations and long‑term development goals.

Formal Education & Certifications

BA/BS in Computer Science, Information Security, Engineering, or related field (non‑tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications).

Relevant industry certifications preferred: CompTIA CySA+, SANS GSEC, GCIA, or foundational automation/cloud certs (e.g., AWS/GCP Cloud Practitioner/Security, basic programming certifications).

Compensation and Benefits

The pay range for this role is $93,900-$156,500. Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant). Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad‑based equity program. Through our benefits program, we strive to offer flexibility, value and choice. From comprehensive health coverage, to a retirement package that includes both a 401(k) and an active pension plan, to highly competitive education reimbursement provisions, paid time off and a mental health benefit, CME Group offers a holistic benefits package for our team and their dependents.

About CME Group

CME Group is the world’s leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it – all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we’re looking for more. At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued. As an equal‑opportunity employer, we consider all potential employees without regard to any protected characteristic.

We enable clients to trade futures, options, cash and OTC markets, optimize portfolios, and analyze data – empowering market participants worldwide to efficiently manage risk and capture opportunities.

Compliance

For U.S. employment, CME Group is legally required to validate a new hire’s employment eligibility by having them complete an Employment Eligibility Verification (Form I-9) companied with legally acceptable proof of identity and work authorization (as listed on the Form I-9). CME Group uses E-Verify, which is an online system operated by the U.S. Department of Homeland Security in partnership with the Social Security Administration to verify employment eligibility and validate social security numbers. Through participation in the E-Verify program, information entered on Form I-9 will be provided and compared to information available at both of these agencies.

See posters below for more details. E-Verify Notice E-Verify Notice Español U.S. Right to Work Notice U.S. Right to Work Notice Español