Cyber Defense Automation Analyst II

CME Group; Chicago (IL); On-site; USD 94,000 - 157,000; Full time

Benefits offered by this job

Equity program

401(k) retirement plan

Health coverage

Education reimbursement

Paid time off

Job summary

CME Group in Chicago seeks a Cyber Defense Analyst II to monitor, triage, and validate security threats while advancing automation and engineering practices within the SOC. You will develop scripts and Siem detections, bridging traditional monitoring with AI-augmented workflows to reduce manual toil and improve detection fidelity.

The role emphasizes hypothesis-driven threat hunting, strong analytical skills, and collaboration with Incident Response and engineering teams.

Qualifications

• 1–3 years of experience in a Level 1 SOC environment or related Information Security role.
• Proficient with Python, Rust, Java, or a related programming language, specifically for automating tasks, interacting with APIs, or processing data (JSON/XML).
• Working knowledge of network protocols, operating system internals (Windows/Linux/macOS), and adversary tactics mapped to the MITRE ATT&CK framework.
• Exposure to or hands-on experience using modern SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines) for alert enrichment and response.
• Familiarity with cloud environments (preferably GCP or AWS) and understanding of cloud-specific telemetry.
• Interest in modern engineering practices, including version control (Git) and basic CI/CD workflows.
• Willingness to learn and adapt to emerging AI capabilities, including using LLMs to assist in security investigations.

Responsibilities

• Perform analysis, triage, and validation of security events across network, host, identity, and cloud (GCP) telemetry to accurately identify malicious activity and filter out false positives.
• Ensure seamless handoffs to the Incident Response team or senior engineers by providing well-documented, contextualized, and enriched security alerts.
• Identify manual, repetitive monitoring tasks within the SOC and write scripts or develop SOAR playbooks to automate them.
• Contribute to our transition to Detection-as-Code (DaC) by assisting in the development, testing, and deployment of SIEM detection rules using version control (Git).
• Utilize and provide operational feedback on new AI-assisted workflows and agentic triage outputs to help engineering teams refine high-accuracy monitoring.
• Participate in hypothesis-driven threat hunts and help operationalize threat intelligence into automated detection mechanisms.
• Collaborate with peers to foster a culture of continuous learning, critical thinking, and automation within the SOC.
• Maintain and update detailed documentation of monitoring processes, playbook logic, and detection schemas within the Knowledge Management System.

Skills

SOC experience

Python

Rust

Java

MITRE ATT&CK

SOAR platforms

Cloud knowledge

CI/CD basics

Git

AI in security

Analytical mindset

Communication

Threat hunting

Education

BA/BS in Computer Science or related field

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Git

Job description

CME Group in Chicago seeks a Cyber Defense Analyst II to monitor, triage, and validate security threats while advancing automation and engineering practices within the SOC. You will develop scripts and Siem detections, bridging traditional monitoring with AI-augmented workflows to reduce manual toil and improve detection fidelity.

The role emphasizes hypothesis-driven threat hunting, strong analytical skills, and collaboration with Incident Response and engineering teams.