Incident Response Engineer – Cyber Defense (2nd Shift)

CME Chicago Mercantile Exchange Inc.; Chicago (IL); On-site; USD 94,000 - 157,000; Full time

Benefits offered by this job

Health coverage

401(k) + pension

Education reimbursement

Paid time off

Mental health benefits

Holistic benefits package

Job summary

CME Group in Chicago, IL is seeking a Cyber Defense Response Analyst II to join our security team. You will respond to and remediate medium-severity cyber incidents, perform DFIR, and hunt threats in a multi-cloud environment, using leading tools and automation.

Ideal candidates will have 2+ years of DFIR, SIEM, and malware analysis experience, strong Python skills, and AWS/GCP/Azure familiarity. This is a second shift role with potential to move to first shift within six months.

Qualifications

• 2+ years of practical DFIR, incident handling, and/or malware analysis.

Responsibilities

• Digital Forensics and Incident Response: drive full incident lifecycle from triage to remediation in a multi-cloud environment.
• Threat Hunting: conduct regular threat hunts to identify misconfigurations and detection gaps.
• Automation & Engineering: use Python and REST APIs to build security tooling and work with automation engineers on advanced use-cases.
• Tabletop Exercises (TTX): lead regular tabletop exercises to improve team readiness.
• Technical Documentation: maintain thorough incident response runbooks and playbooks.

Skills

DFIR

Threat Hunting

Python

REST APIs

Cloud Experience

IT Fundamentals

Education

BA/BS in Engineering or CS

Security Certifications (GCIH GCFE GCFA OSCP Sec+)

Tools

KAPE

EnCase

Cellebrite

FTK

Magnet Axiom

Autopsy

Ghidra

IDA Pro

PEStudio

x64dbg

Job description

CME Group in Chicago, IL is seeking a Cyber Defense Response Analyst II to join our security team. You will respond to and remediate medium-severity cyber incidents, perform DFIR, and hunt threats in a multi-cloud environment, using leading tools and automation.

Ideal candidates will have 2+ years of DFIR, SIEM, and malware analysis experience, strong Python skills, and AWS/GCP/Azure familiarity. This is a second shift role with potential to move to first shift within six months.