Cyber Incident Response Analyst II - Second Shift (Convertible to Day)

CME Group; Chicago (IL); On-site; USD 94,000 - 157,000; Full time

Job summary

CME Group in Chicago is seeking a Cyber Defense Response Analyst II to respond to and remediate cyber incidents across multi-cloud environments, with a strong emphasis on DFIR, threat hunting, and automation.

The role is mid-level, supports second shift 12p-8p CT with potential conversion to first shift within six months, and offers access to top-tier tools, training, and a comprehensive benefits package.

Qualifications

• 2+ years of practical experience with Digital Forensics, Incident Handling, and/or Malware Analysis.
• 2+ years of experience with Q Radar, Sentinel, Splunk, Chronicle, ArcSight, or similar log management technologies.
• 2+ years with tools such as KAPE, EnCase, Cellebrite, FTK, Magnet Axiom, Autopsy, and malware analysis tools like Ghidra, Ida Pro, PEStudio, x64dbg.
• Strong understanding of computer networking, operating systems, and their intersection with Cybersecurity.
• Development experience with Python, for data manipulation (Pandas) and interacting with REST APIs.
• Practical experience with AWS, GCP, or Azure.

Responsibilities

• Drive the full incident response lifecycle from triage to remediation across multi-cloud environments.
• Conduct regular threat hunts to identify misconfigurations and detection gaps.
• Use Python and REST APIs to build security tooling and integrate with automation teams.
• Lead tabletop exercises to improve team readiness.
• Contribute to internal runbooks and playbooks with accurate, current workflows.

Skills

DFIR

SIEM / Log Analysis

Forensics Tools

Networking Fundamentals

Python

REST APIs

Cloud Platforms (AWS/GCP/Azure)

Education

BA/BS in Engineering, Computer Science, or Information Security

Tools

KAPE

EnCase

Cellebrite

FTK

Magnet Axiom

Autopsy

Ghidra

IDA Pro

PEStudio

x64dbg

Job description

CME Group in Chicago is seeking a Cyber Defense Response Analyst II to respond to and remediate cyber incidents across multi-cloud environments, with a strong emphasis on DFIR, threat hunting, and automation.

The role is mid-level, supports second shift 12p-8p CT with potential conversion to first shift within six months, and offers access to top-tier tools, training, and a comprehensive benefits package.