Chicago Mercantile Exchange

Cyber Defense Analyst III

Chicago, Cook County · Mid

Sponsorship not specified$104k-$173kDetected 21 days ago
PythonPowerShellGitAWSGCPCloud PlatformsCI/CDLinuxRESTLLMsCybersecuritySIEMSOARSOC OperationsDetection EngineeringIncident ResponseTCP/IPCommunicationProblem SolvingCritical ThinkingMentoring

Stay score

odds of building a lasting career here

59Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role100
Entry-level history0
PERM / green-card track0
Lottery odds (Level III)83
Fits your clock70

Sponsors, but it's cap-subject — you still face the weighted lottery (~45% per draw at Level III). Good if you win; have a cap-exempt backup on your list.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Green-card filing pattern in this occupation

Context, not a finding about this posting: of this employer's 34 green-card filings in this occupation, 100% were for a worker who already held the job.

Green-card follow-through: 43%

Of 21 labor certifications old enough to have been used, 12 expired without the employer filing the next step. Median time from filing to decision: 478 days.100% of their filings were for a worker who already held the job.Only certifications past the 180-day window are counted — recent ones cannot have expired yet.

Files H-1B transfers

7 transfer filings in the last year, covering 7 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • The Cyber Defense Engineer III position is responsible for monitoring, detecting, and validating complex security threats.
  • As our Security Operations Center transitions toward an engineering and automation-first model, this role acts as a critical bridge between traditional cyber defense monitoring and modern development practices.
  • The pay range for this role is $103,500-$172,500.

Responsibilities

  • Perform deep-dive analysis and validation of complex security events across network, host, identity, and cloud (GCP) telemetry to accurately identify malicious activity and reduce false positives.
  • Proactively identify manual, repetitive monitoring tasks within the SOC and write Python scripts or build SOAR playbooks to automate them.
  • Support our transition to Detection-as-Code (DaC) by developing, testing, tuning, and deploying SIEM detection rules using version control (Git) and CI/CD pipelines.
  • Partner with our global engineering and automation teams to test, validate, and refine new AI-assisted workflows and agentic triage outputs to ensure high operational accuracy in our monitoring ecosystem.
  • Maintain detailed documentation of monitoring processes, playbook logic, and detection schemas within the Knowledge Management System.
  • Hands-on experience building, maintaining, or modifying playbooks within modern SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Torq, or Tines).
  • And build a career by shaping tomorrow.
  • We invest in your success and you own it - all while working alongside a team of leading experts who inspire you in ways big and small.

Requirements

  • 4-6 years of dedicated experience in a Security Operations Center (SOC), Detection Engineering, or advanced Cyber Defense monitoring environment.
  • Deep knowledge of network protocols, operating system internals (Windows/Linux/macOS), and adversary tactics mapped to the MITRE ATT&CK framework.
  • Practical proficiency in Python or PowerShell, specifically for interacting with REST APIs, parsing JSON/XML, and automating daily security monitoring tasks.
  • Familiarity with cloud environments (preferably GCP or AWS) and investigating cloud-specific telemetry and identity abuse.
  • Experience or strong interest in modern engineering practices, including version control (Git), Detection-as-Code, and basic CI/CD workflows.
  • BA/BS in Computer Science, Information Security, Engineering, or related field (non-tech degrees acceptable with appropriate levels of Information Security job experience and/or certifications).

Nice to have

  • Relevant industry certifications strongly preferred: SANS GCIA, GCFA, GCDA, or practical automation/cloud certs (e.g., SEC573, AWS/GCP Security).

Compensation

  • The pay range for this role is $103,500-$172,500.
  • Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant).
  • Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad-based equity program.

Benefits

  • CME Group is committed to offering a competitive total rewards package for our employees that recognizes their contributions to the business and reflects our long-term investment in their future.
  • Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant).
  • Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad-based equity program.
  • Through our benefits program, we strive to offer flexibility, value and choice.

Company info

  • At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone's perspectives are acknowledged and valued.
  • But who we are goes deeper than that.
  • And we're looking for more.
Apply directly at Chicago Mercantile Exchange →Create a free account for alerts like thisView Chicago Mercantile Exchange immigration profile

This listing is sourced directly from Chicago Mercantile Exchange's careers page and normalized into a canonical job model.