Cyber Defense Response Analyst II

CME Chicago Mercantile Exchange Inc.; New York (NY); Hybrid; USD 103,000 - 172,000; Full time

Benefits offered by this job

Hybrid work model

SANS training

Professional development programs

Job summary

CME Group in New York seeks a mid‑level Cyber Defense Response Analyst II to join a hybrid security team. You will perform incident response, forensics, and threat hunting across multi‑cloud environments, leveraging Python and REST APIs to automate tools and workflows.

The role requires 2+ years in DFIR, with strong SIEM experience and hands‑on with leading forensics tools. A focus on high‑quality documentation and collaboration completes the profile.

Qualifications

• 2+ years of DFIR, incident handling, or malware analysis.
• 2+ years with QRadar, Sentinel, Splunk, Chronicle, ArcSight, or similar.
• 2+ years using leading forensics tools: KAPE, EnCase, Cellebrite, FTK, Magnet AXIOM, Autopsy.
• Strong IT fundamentals: networking and operating systems in cybersecurity contexts.
• Python development for data manipulation (Pandas) and REST APIs.
• Cloud experience: AWS, GCP, or Azure.

Responsibilities

• Drive the full incident response lifecycle from triage to remediation, including endpoint forensics and malware analysis in a multi‑cloud environment.
• Conduct regular threat hunts to identify misconfigurations and detection gaps.
• Build/integrate security tools using Python and REST APIs, coordinating with automation engineers for advanced use‑cases.
• Lead tabletop exercises to improve team readiness.
• Contribute to internal incident response runbooks and playbooks with current workflows.

Skills

DFIR

SIEM

Forensics tools

Malware analysis

Networking basics

Python

Cloud

QRadar

Endpoint Forensics

Education

BA/BS in Engineering, CS or InfoSec

GCIH/GCFE/GCFA/OSCP/Sec+ certifications

Tools

KAPE

EnCase

Cellebrite

FTK

Magnet AXIOM

Autopsy

Ghidra

IDA Pro

PEStudio

x64dbg

Job description

The Cyber Defense Response Analyst II is a mid-level technical role focused on responding to and remediating cyber incidents at CME Group, a major player in global financial markets. We are looking for someone who finds joy in the inner workings of technology, with the occasional tendency to get lost in deep research. In this role, you will use industry leading tools while responding to medium‑severity incidents in collaboration with teammates around the globe. We provide autonomy and a supportive learning environment with access to top‑tier technology, opportunities to align project work with your individual interests, and extensive training programmes, including annual SANS training.

Work Model: Hybrid. Candidates must be based within commuting distance of our New York, NY office prior to their start date, with a mandatory 2 days per week on‑site.

Primary Responsibilities

• Digital Forensics and Incident Response: Drive the full incident response lifecycle from initial triage to remediation, confidently applying specialty skills like endpoint forensics and malware analysis. Be ready to operate in a multi‑cloud environment.
• Threat Hunting: Conduct regular threat hunts to identify misconfigurations, detection gaps, and other anomalies.
• Automation & Engineering: Use AI, Python and REST APIs to build/integrate security tools for incident response needs, while working with automation engineers to develop heavy‑duty solutions for advanced use‑cases.
• Tabletop Exercises (TTX): Lead regular tabletop exercises to improve team readiness.
• Technical Documentation: Contribute continuously to our internal knowledge base of incident response runbooks and playbooks, keeping it exhaustive, accurate, and reflective of the latest workflows.

Ideal Candidate Attributes

• Innate Curiosity: An exceptional level of curiosity and a track record of self‑teaching advanced technical concepts.
• Highly Innovative: You have a consistent record of taking unorthodox approaches to challenges and a demonstrated ability to innovate within information technology domains.
• A "Researcher" Mindset: A passion for collecting facts, debating details, and diving into "rabbit holes" to solve complex problems.
• Adept at High‑Pressure Communication: Ability to deal effectively at all levels of the organization and translate technical research into clear, actionable intelligence for leadership.
• Highly Detail Oriented: Very strong attention to detail; you notice things others often don’t.
• Impactfully Collaborative: You excel at technical collaboration and helping teams deliver high‑impact.

Preferred Technical Qualifications

• DFIR Background: 2+ years of practical experience with Digital Forensics, Incident Handling, and/or Malware Analysis.
• SIEM/Data Analysis: 2+ years of experience with Q Radar, Sentinel, Splunk, Chronicle, ArcSight, or similar log management technologies.
• Experience using leading forensics tools: 2+ years of experience using tools such as KAPE, EnCase, Cellebrite, FTK, Magnet Axiom, and Autopsy, plus comfort with malware analysis tools like Ghidra, Ida Pro, PEStudio, and x64dbg.
• Strong IT Fundamentals: Strong understanding of computer networking, operating systems, and their intersection with Cybersecurity.
• Programming Skills: Development experience with Python, specifically for data manipulation (Pandas) and interacting with REST APIs.
• Cloud Experience: Practical experience with AWS, GCP, or Azure.

Education & Certifications

• Education: BA/BS in Engineering, Computer Science, or Information Security (non‑tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications).
• Certifications: GCIH, GCFE, GCFA, OSCP, Sec+, and similar cyber‑oriented certifications are desired.

CME Group is committed to offering a competitive total rewards package for our employees that recognises their contributions to the business and reflects our long‑term investment in their future. The pay range for this role is $103,200-$172,000. Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant). Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad‑based equity program.

Benefits

• Comprehensive health coverage
• A retirement package that includes both a 401(k) and an active pension plan
• Highly competitive education reimbursement provisions
• Paid time off
• A mental health benefit

CME Group: Where Futures are Made

CME Group is the world’s leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it – all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we’re looking for more. At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued.

As an equal‑opportunity employer, we consider all potential employees without regard to any protected characteristic.

As the world’s leading derivatives marketplace, CME Group is where the world comes to manage risk. We enable clients to trade futures, options, cash and OTC markets, optimise portfolios, and analyse data – empowering market participants worldwide to efficiently manage risk and capture opportunities. CME Group exchanges offer the widest range of global benchmark products across all major asset classes based on interest rates, equity indexes, foreign exchange, energy, agricultural products and metals. We meet uncertainty and volatility with confidence and clarity, across the trading lifecycle and around the world.

For U.S. employment, CME Group is legally required to validate a new hire’s employment eligibility by having them complete an Employment Eligibility Verification (Form I‑9) accompanied with legally acceptable proof of identity and work authorisation (as listed on the Form I‑9). CME Group uses E‑Verify, which is an online system operated by the U.S. Department of Homeland Security in partnership with the Social Security Administration to verify employment eligibility and validate social security numbers. Through participation in the E‑Verify program, information entered on Form I‑9 will be provided and compared to information available at both of these agencies. See posters below for more details.

E‑Verify Notice

E‑Verify Notice Español

U.S. Right to Work Notice

U.S. Right to Work Notice Español