Cyber Defense Analyst II

Chicago Mercantile Exchange•Chicago, IL

About The Position

The Cyber Defense Analyst II monitors, detects, and validates security threats across the organization’s environment. As the Security Operations Center moves toward an engineering- and automation-first model, this role combines cyber defense monitoring with modern development practices. The analyst performs telemetry analysis and alert triage while identifying process bottlenecks and developing automation to reduce manual work, improve detection fidelity, and support AI-augmented triage workflows. The role analyzes security events across network, host, identity, and cloud (GCP) telemetry; documents and enriches alerts for Incident Response and senior engineers; develops scripts and SOAR playbooks; and contributes to version-controlled SIEM detection rules. It also supports AI-assisted workflows, threat hunting, threat-intelligence operationalization, SOC collaboration, and documentation of monitoring processes and detection schemas.

Requirements

1–3 years of experience in a Level 1 SOC environment or a related Information Security role.
Proficiency in Python, Rust, Java, or a related programming language for automating tasks, interacting with APIs, or processing JSON/XML data.
Working knowledge of network protocols, Windows/Linux/macOS operating system internals, and adversary tactics mapped to MITRE ATT&CK.
Exposure to or hands-on experience with modern SOAR platforms for alert enrichment and response.
Familiarity with cloud environments, preferably GCP or AWS, and understanding of cloud-specific telemetry.
Interest in engineering practices, including Git version control and basic CI/CD workflows.
Willingness to learn and adapt to emerging AI capabilities, including use of LLMs in security investigations.
Strong analytical and problem-solving skills, curiosity, and interest in improving efficiency.
Excellent communication skills, including the ability to turn telemetry and log data into clear, actionable summaries.
Self-motivation and ability to balance alert analysis with automation and playbook-development projects.
Collaborative approach to connecting daily monitoring operations with longer-term development goals.
BA/BS in Computer Science, Information Security, Engineering, or a related field; non-technical degrees are acceptable with appropriate Information Security job experience and/or certifications.

Nice To Haves

Relevant industry certifications such as CompTIA CySA+, SANS GSEC, or GCIA.
Foundational automation or cloud certifications, such as AWS/GCP Cloud Practitioner or Security certifications, or basic programming certifications.
Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, Torq, or Tines.

Responsibilities

Analyze, triage, and validate security events across network, host, identity, and cloud (GCP) telemetry to identify malicious activity and filter false positives.
Provide well-documented, contextualized, and enriched security alerts for handoff to the Incident Response team or senior engineers.
Identify repetitive SOC monitoring tasks and automate them with scripts or SOAR playbooks.
Assist with developing, testing, and deploying SIEM detection rules using version control as part of the transition to Detection-as-Code.
Use and provide operational feedback on AI-assisted workflows and agentic triage outputs.
Participate in hypothesis-driven threat hunts and help operationalize threat intelligence into automated detections.
Collaborate with peers to foster continuous learning, critical thinking, and automation within the SOC.
Maintain documentation of monitoring processes, playbook logic, and detection schemas in the Knowledge Management System.