{"id":1170299,"url":"https://alion.io/job/cme-group-cyber-defense-analyst-iii","title":"Cyber Defense Analyst III","company":{"id":33863,"name":"CME Group","domain":"cmegroup.com","url":"https://alion.io/company/cmegroup","size_band":"1001-5000","is_staffing_agency":false,"is_intermediary":false,"ats_vendor":"Workday","truth_index":{"grade":"A","score":92,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":49,"computed_at":"2026-09-24T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":103500,"max":172500,"currency":"USD","period":"year","gross":null,"usd_annual":172500},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Tines","optional":false},{"name":"Windows","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-09-24T07:01:25Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-09-24T07:01:25Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"The Cyber Defense Engineer III position is responsible for monitoring, detecting, and validating complex security threats. As our Security Operations Center transitions toward an engineering and automation-first model, this role acts as a critical bridge between traditional cyber defense monitoring and modern development practices. You will take a leading role in deep-dive telemetry analysis while dedicating significant time to identifying process bottlenecks, developing automation scripts, and integrating security telemetry into our SOAR platforms.\nThis position is ideal for candidates looking to evolve their career by applying an engineering mindset to everyday monitoring challenges, helping us eliminate manual toil, improve detection fidelity, and support the deployment of AI-augmented triage workflows.\nPosition Responsibilities\nPerform deep-dive analysis and validation of complex security events across network, host, identity, and cloud (GCP) telemetry to accurately identify malicious activity and reduce false positives.\n\nEnsure seamless handoffs to the Incident Response team by providing highly contextualized, enriched, and validated security alerts.\n\nProactively identify manual, repetitive monitoring tasks within the SOC and write Python scripts or build SOAR playbooks to automate them.\n\nSupport our transition to Detection-as-Code (DaC) by developing, testing, tuning, and deploying SIEM detection rules using version control (Git) and CI/CD pipelines.\n\nPartner with our global engineering and automation teams to test, validate, and refine new AI-assisted workflows and agentic triage outputs to ensure high operational accuracy in our monitoring ecosystem.\n\nConduct proactive, hypothesis-driven threat hunts and operationalize threat intelligence into new, automated detection mechanisms.\n\nProvide technical mentorship to junior monitoring analysts, fostering a culture of continuous learning, critical thinking, and automation within the SOC.\n\nMaintain detailed documentation of monitoring processes, playbook logic, and detection schemas within the Knowledge Management System.\n\nPosition Requirements\nExperience & Technical Skills\n4-6 years of dedicated experience in a Security Operations Center (SOC), Detection Engineering, or advanced Cyber Defense monitoring environment.\n\nDeep knowledge of network protocols, operating system internals (Windows/Linux/macOS), and adversary tactics mapped to the MITRE ATT&CK framework.\n\nPractical proficiency in Python or PowerShell, specifically for interacting with REST APIs, parsing JSON/XML, and automating daily security monitoring tasks.\n\nHands-on experience building, maintaining, or modifying playbooks within modern SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines).\n\nFamiliarity with cloud environments (preferably GCP or AWS) and investigating cloud-specific telemetry and identity abuse.\n\nExperience or strong interest in modern engineering practices, including version control (Git), Detection-as-Code, and basic CI/CD workflows.\n\nWillingness to learn and adapt to emerging AI capabilities, including testing and refining LLM prompts for security investigations.\n\nSoft Skills & Competencies\nStrong analytical and problem-solving mindset; naturally curious about how things work and how to make them more efficient.\n\nExcellent communication skills, capable of translating complex telemetry into clear, actionable summaries for Incident Response and engineering peers.\n\nHighly self-directed, able to balance active alert analysis with long-term automation and playbook development projects.\n\nCollaborative team player who enjoys mentoring peers and bridging the gap between monitoring operations and development teams.\n\nFormal Education & Certifications\nBA/BS in Computer Science, Information Security, Engineering, or related field (non-tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications).\n\nRelevant industry certifications strongly preferred: SANS GCIA, GCFA, GCDA, or practical automation/cloud certs (e.g., SEC573, AWS/GCP Security).\n\nCME Group is committed to offering a competitive total rewards package for our employees that recognizes their contributions to the business and reflects our long-term investment in their future. The pay range for this role is $103,500-$172,500. Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant). Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad-based equity program. Through our benefits program, we strive to offer flexibility, value and choice. From comprehensive health coverage, to a retirement package that includes both a 401(k) and an active pension plan, to highly competitive education reimbursement provisions, paid time off and a mental health benefit, CME Group offers a holistic benefits package for our team and their dependents.CME Group: Where Futures are Made\nCME Group is the world’s leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it - all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we’re looking for more.\nAt CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued. As an equal-opportunity employer, we consider all potential employees without regard to any protected characteristic.\nImportant Notice: Recruitment fraud is on the rise, with scammers using misleading promises of job offers and interviews to solicit money and personal information from job seekers. CME Group adheres to established procedures designed to maintain trust, confidence and security throughout our recruitment process. Learn more here.","description_format":"text","description_chars":6155,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Marketplaces","Security Operations"],"lifecycle":[{"event":"open","at":"2026-09-24T07:01:25Z"}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":49,"reasons":["conf:2","win:early"],"computed_at":"2026-09-24T09:05:09Z"},"pay":{"stated_usd_annual":172500,"is_top_pay":true},"html_url":"https://alion.io/job/cme-group-cyber-defense-analyst-iii","json_url":"https://alion.io/job/cme-group-cyber-defense-analyst-iii.json","meta":{"generated_at":"2026-09-24T09:05:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers"}}