Cyber Defense Automation Engineer II

CME Chicago Mercantile Exchange Inc.; Chicago (IL); On-site; USD 94,000 - 157,000; Full time

Job summary

CME Group is seeking a Cyber Defense Analyst II to monitor, triage, and validate security events across network, host, identity and cloud telemetry. You will help automate repetitive tasks, contribute to Detection-as-Code, and leverage AI-augmented triage workflows to improve detection fidelity.

The role emphasizes engineering-minded security, collaboration with Incident Response and engineering peers, and ongoing documentation of monitoring processes and detection schemas.

Qualifications

• 1-3 years in a Level 1 SOC or related InfoSec role.
• Proficiency in Python, Rust, or Java for automation and data processing.
• Familiarity with MITRE ATT&CK and cloud telemetry (GCP/AWS).
• Experience with SOAR platforms for alert enrichment and response.

Responsibilities

• Analyze, triage, and validate security events across network, host, identity, and cloud telemetry.
• Provide well-documented, contextualized alerts for incident response and engineering teams.
• Identify manual tasks and write scripts or playbooks to automate monitoring.
• Contribute to Detection-as-Code by developing and deploying SIEM rules.
• Evaluate AI-augmented workflows and refine triage outputs.
• Support threat hunts and operationalize threat intelligence into detections.
• Maintain documentation of monitoring processes and detection schemas.

Skills

Python

Rust

Java

Education

BA/BS in Computer Science, Information Security, Engineering

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Job description

CME Group is seeking a Cyber Defense Analyst II to monitor, triage, and validate security events across network, host, identity and cloud telemetry. You will help automate repetitive tasks, contribute to Detection-as-Code, and leverage AI-augmented triage workflows to improve detection fidelity.

The role emphasizes engineering-minded security, collaboration with Incident Response and engineering peers, and ongoing documentation of monitoring processes and detection schemas.