Lead Security Engineer - DevSecOps
About The Position
The Lead Security Engineer - DevSecOps at CME Group contributes to software security design, secure SDLC practices, and secure design patterns with minimal task-level oversight. The role is a constructive, communicative team member and mentor who contributes to security strategy and roadmap planning, serves as a security liaison to external groups, and develops secure reference designs and products across Global Information Security (GIS) and the wider enterprise. The position requires deep software engineering expertise and experience with secure SDLC disciplines, including cryptography, authentication and authorization, secure data handling, auditing, and input validation. It also calls for knowledge of modern software architectures such as microservices and Cloud Native designs, as well as software-defined deployments including CI/CD pipelines, Infrastructure-as-Code, and immutable and idempotent declarative principles. Basic familiarity with frameworks such as CIS, NIST 800, PCI, and HIPAA, and exposure to security technologies such as IDS/IPS and WAF, are desirable. The role has enterprise-wide impact through shaping security standards and architectures across engineering divisions. It offers exposure to CME Group products, asset classes, and cross-functional teams in an environment described as supportive of career progression, continuous learning, and inclusion.
Requirements
- Bachelor's or Master's degree in Computer Science, Information Systems, or a related field, or equivalent work experience.
- At least 8 years of application development and/or infrastructure engineering experience.
- At least 2 years of hands-on experience with application deployments in a cloud environment such as AWS, GCP, or Azure.
- Experience with DevSecOps tools and frameworks for Infrastructure-as-Code, such as CloudFormation, Terraform, Chef, Puppet, or Ansible.
- Experience with DevSecOps tools such as Jenkins, Maven, Git, and Ansible.
- Experience with containers and container systems such as Docker and Kubernetes.
- Experience writing code and scripts to automate AWS service provisioning and configuration using tools and languages such as AWS CLI/API, Jenkins, Python, Bash, and Git.
- Experience with Java, Python, and JavaScript (Node.js); .NET (C#, C++) may also be relevant.
- Experience with logging and monitoring tools such as CloudWatch and Splunk.
- Experience with ticketing systems such as Jira.
- Familiarity with current and emerging software development technologies and architecture patterns, especially Cloud Native technologies.
- Ability to work across teams and geographic locations.
- Excellent oral and written communication skills.
- Relevant experience designing, implementing, and supporting larger-scale software products.
- Deep software engineering expertise and experience with secure SDLC disciplines, including cryptography, authentication and authorization, secure data handling, auditing, and input validation.
- Understanding of modern software architectures, including microservices, Cloud Native designs, CI/CD pipelines, Infrastructure-as-Code, and immutable and idempotent declarative principles.
- High programming-language proficiency, with mastery in at least one primary language area.
Nice To Haves
- Basic technical understanding of security frameworks such as CIS, NIST 800, PCI, and HIPAA.
- Exposure to security technologies such as IDS/IPS and WAF.
- Familiarity with the Atlassian (Jira) SDK and Atlassian development process.
- Experience with UX/UI design, wireframing, and major client-side visualization libraries such as D3.js.
- One or more desirable certifications: CISSP, CSSLP, GSSP-, CASE, CERT Secure Coding, or PECB Lead Secure Application Developer.
Responsibilities
- Drive and contribute to secure software reference designs, delivery systems, and enterprise-wide solutions that demonstrate secure coding principles and practices.
- Make primary contributions to implementing software products within the GIS team, covering the Secure SDLC process through maturity.
- Conduct unit, integration, and system testing of code and contributed projects.
- Write unit tests for test-driven implementations with minimal guidance.
- Apply programming-language expertise, including mastery of at least one primary language area.
- Use knowledge of databases and data architectures to securely access and incorporate them throughout an application's execution lifecycle.
- Identify opportunities for code optimization.
- Contribute to code reviews and assist with environment build deployment, including local mockups and CI/CD, release notes, and build notices.
- Create development documentation such as use cases, user requirements, design and technical specifications, process flows, data flow diagrams, sequence diagrams, and communications diagrams.
- Review code to proactively identify and mitigate potential issues and defects, identify defect sources, and troubleshoot code.
- Collaborate with peers across CME Group divisions to develop applied examples of reference architectures and establish the next generation of secure SDLC through implementation projects.
- Contribute to software security strategy and roadmap planning, mentor others, and serve as a security liaison to external groups.
Benefits
- Competitive salary and comprehensive benefits package.
- Annual target bonus opportunity.
- Opportunity to become an owner through a broad-based equity program.
- Comprehensive health coverage.
- Retirement package including a 401(k) and an active pension plan.
- Education reimbursement provisions.
- Paid time off.
- Mental health benefit.
- Benefits for employees and their dependents.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
