Senior Cyber Defense Engineer - Automation & SIEM

CME Chicago Mercantile Exchange Inc.; Chicago (IL); On-site; USD 104,000 - 173,000; Full time

Benefits offered by this job

Health coverage

401(k)

Equity program

Education reimbursement

Paid time off

Mental health benefits

Job summary

CME Group is seeking a Cyber Defense Engineer III to monitor, detect, and validate complex security threats. The role bridges traditional monitoring and modern engineering practices, focusing on automated telemetry, DaC rules, and AI-assisted triage workflows.

Responsibilities include deep-dive analysis, automating tasks with Python and SOAR, and mentoring junior analysts. A strong foundation in MITRE ATT&CK, cloud telemetry, and CI/CD is preferred.

Qualifications

• 4–6 years of dedicated SOC or cyber defense monitoring experience.
• Deep knowledge of network protocols, OS internals, and MITRE ATT&CK mappings.
• Proficiency in Python or PowerShell for REST APIs, JSON/XML parsing, and automation.
• Hands-on experience building or modifying playbooks in modern SOAR platforms.
• Familiarity with cloud environments (GCP/AWS) and cloud telemetry investigation.
• Experience with Git and CI/CD basics in monitoring workflows.
• Willingness to learn AI capabilities and test LLM prompts for investigations.

Responsibilities

• Perform deep-dive analysis and validation of complex security events across network, host, identity, and cloud telemetry.
• Provide highly contextualized, enriched alerts to Incident Response.
• Automate repetitive monitoring tasks via Python scripts or SOAR playbooks.
• Develop, test, tune, and deploy SIEM detection rules with Git/CI/CD pipelines.
• Collaborate with global engineering teams to validate AI-assisted workflows.

Skills

SOC experience

Python/PowerShell

SOAR platforms

Cloud telemetry

MITRE ATT&CK

CI/CD basics

Education

BA/BS in Computer Science or related field

Tools

Cortex XSOAR

Splunk SOAR

Torq

Tines

Job description

CME Group is seeking a Cyber Defense Engineer III to monitor, detect, and validate complex security threats. The role bridges traditional monitoring and modern engineering practices, focusing on automated telemetry, DaC rules, and AI-assisted triage workflows.

Responsibilities include deep-dive analysis, automating tasks with Python and SOAR, and mentoring junior analysts. A strong foundation in MITRE ATT&CK, cloud telemetry, and CI/CD is preferred.