Cyber Defense Analyst II

CME Group • Chicago, IL

1d • $93,900 - $156,500

About The Position

The Cyber Defense Analyst II monitors, detects, and validates security threats across the organization’s environment. As the Security Operations Center moves toward an engineering- and automation-first model, this role bridges cyber defense monitoring with modern development practices. The analyst performs telemetry analysis and alert triage while identifying process bottlenecks and creating automation to improve workflows.

The role focuses on reducing manual work, improving detection fidelity, and supporting AI-augmented triage. It includes analyzing security events across network, host, identity, and GCP cloud telemetry; enriching and documenting alerts for handoff; automating repetitive tasks with scripts or SOAR playbooks; and contributing to version-controlled detection rules and threat-hunting efforts. The analyst also provides feedback on AI-assisted triage workflows and maintains documentation of monitoring processes, playbook logic, and detection schemas.

CME Group offers a competitive total rewards package, including an annual target bonus opportunity, broad-based equity program, health coverage, a 401(k) and active pension plan, education reimbursement, paid time off, and a mental health benefit. The listed pay range is $93,900–$156,500; the actual salary depends on factors including experience, skills, education, and internal comparisons.

Requirements

• 1–3 years of experience in a Level 1 SOC environment or a related Information Security role.
• Proficiency in Python, Rust, Java, or a related programming language for automation, API interaction, or processing JSON/XML data.
• Working knowledge of network protocols, Windows/Linux/macOS operating system internals, and adversary tactics mapped to the MITRE ATT&CK framework.
• Exposure to or hands-on experience with modern SOAR platforms for alert enrichment and response.
• Familiarity with cloud environments, preferably GCP or AWS, and an understanding of cloud-specific telemetry.
• Interest in version control with Git and basic CI/CD workflows.
• Willingness to learn and adapt to emerging AI capabilities, including using LLMs to assist in security investigations.
• Strong analytical and problem-solving skills, curiosity, and an interest in improving efficiency.
• Excellent communication skills, including the ability to translate telemetry and log data into clear, actionable summaries for Incident Response and engineering peers.
• Ability to balance active alert analysis with assigned automation and playbook development projects.
• Collaborative approach to bridging monitoring operations and development goals.
• BA/BS in Computer Science, Information Security, Engineering, or a related field; non-technical degrees are acceptable with appropriate Information Security job experience and/or certifications.

Nice To Haves

• Relevant industry certifications such as CompTIA CySA+, SANS GSEC, or GCIA.
• Foundational automation or cloud certifications, such as AWS/GCP Cloud Practitioner/Security, or basic programming certifications.
• Experience with Cortex XSOAR, Splunk SOAR, Torq, or Tines.

Responsibilities

• Analyze, triage, and validate security events across network, host, identity, and GCP cloud telemetry to identify malicious activity and filter false positives.
• Provide well-documented, contextualized, and enriched security alerts for handoffs to the Incident Response team or senior engineers.
• Identify manual, repetitive SOC monitoring tasks and automate them with scripts or SOAR playbooks.
• Assist in developing, testing, and deploying SIEM detection rules using version control as part of the transition to Detection-as-Code.
• Provide operational feedback on AI-assisted workflows and agentic triage outputs to help improve monitoring accuracy.
• Participate in hypothesis-driven threat hunts and help operationalize threat intelligence into automated detections.
• Collaborate with peers to promote continuous learning, critical thinking, and automation within the SOC.
• Maintain detailed documentation of monitoring processes, playbook logic, and detection schemas in the Knowledge Management System.

Benefits

• Annual target bonus opportunity for all employees.
• Opportunity to become an owner through a broad-based equity program.
• Comprehensive health coverage.
• 401(k) and an active pension plan.
• Education reimbursement provisions.
• Paid time off.
• Mental health benefit.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level