CME Group
Lead Vulnerability Engineer
CME Group, Chicago, Illinois, United States, 60290
The
Lead
Vulnerability Engineer has advanced knowledge and provides support for detection, assessment, communication, and remediation coordination of security vulnerabilities, as well as support for file integrity monitoring and OS configuration management compliance. The incumbent must have advanced knowledge of Linux/Windows server and application administration and configuration, networking, scripting and automation, distributed computing, cloud technologies, and security. Ability to work independently as well as communication, documentation, and strong problem-solving skills are required to collaborate with more senior engineers and select information technology areas with minimal supervision.
Lead Vulnerability Engineer:
- Focuses on the detection, prioritization, and remediation of vulnerabilities in accordance with best practices.
- Supports information technology teams in remediating vulnerabilities and provides advanced troubleshooting.
- Leads managing Qualys vulnerability scanning infrastructure to include configuring and scheduling scans, conducting ad-hoc scans, and creating reports.
- Leads managing vulnerability scanning and remediation of GKE container images in GCP.
- Supports file integrity monitoring and OS configuration management compliance processes and works with technology teams on resolving the findings.
- Uses JIRA ticketing system to manage vulnerability lifecycle and tracks SLA breaches.
- Leverages other enterprise tools such as Splunk, BMC Discovery, BMC CMDB, Snow to assist in assessing vulnerabilities and risk and maintaining an accurate asset inventory for complete scan coverage.
- Uses Archer GRC platform to manage vulnerability remediation risk exception process.
- Leads the continuous improvement of the enterprise vulnerability management program.
- Has 7+ years of vulnerability management, systems engineering, or networking experience.
Principal Accountabilities:
- Provides advanced knowledge of best practices and mainly known issues of vulnerability scanning, file integrity monitoring, and the associated services, schedules, and reporting processes with minimal supervision.
- Provides advanced support in evaluation and remediation of mainly known vulnerabilities and known issues with unauthorized change detection. Documents issues, if necessary.
- Defines complex problem statements, gathers and compares data about problems, documents the details, and prepares analysis reports, seeking out all feasible alternatives. Prioritizes the alternatives and works out a plan for execution with minimal supervision.
- Demonstrates advanced understanding of most of the following: Linux/Windows server and application administration and configuration, networking, scripting and automation, large scale distributed computing architecture (client server, cloud, intranet/internet), hardware/operating system/application interaction, and security.
- Collaborates with all levels within the technology division to determine an optimal solution for stakeholders based on mainly known solutions.
- Provides advanced technical advice to other teams within technology on mainly known security solutions.
- Leads in gathering data to assist in setting policies.
- Recommends mainly known alternatives to increase security for application configuration and environment build out for new projects.
- Stays up to date on security trends, vulnerability alerts and advisories.
Skills & Software Requirements:
- Linux/Windows administration and configuration
- Scripting (bash, Powershell)
- Basic networking
- Experience with vulnerability scanning tools (Qualys, Nessus, Rapid7, etc.)
- Familiarity with issue tracking systems (JIRA, Remedy, etc.)
- Familiarity with collaboration tools (Confluence, etc.)
Nice to Have:
- Industry certification (CompTIA Security+, CISSP, CCSP, SSCP, etc.)
- Experience with container scanning technologies
- Experience with vulnerability management in GCP
- Experience with Tripwire
- Java or Python programming experience
- Experience with Splunk, BMC Discovery, Snow, BMC CMDB
#LI-RP1
#LI-Hybrid
CME Group is committed to offering a competitive total rewards package for our employees that recognizes their contributions to the business and reflects our long-term investment in their future. The salary range for this role is $113,600-$189,400. Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant). Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad-based equity program. Through our Benefits program, we strive to offer flexibility, value and choice. From comprehensive health coverage, to a retirement package that includes both a 401(k) and an active Pension Plan, to highly competitive education reimbursement provisions, paid time off and a mental health benefit, CME Group offers a holistic Benefits package for our team and their dependents.
CME Group : Where Futures are Made
CME Group is the world's leading and most diverse derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it - all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we're looking for more.
Lead
Vulnerability Engineer has advanced knowledge and provides support for detection, assessment, communication, and remediation coordination of security vulnerabilities, as well as support for file integrity monitoring and OS configuration management compliance. The incumbent must have advanced knowledge of Linux/Windows server and application administration and configuration, networking, scripting and automation, distributed computing, cloud technologies, and security. Ability to work independently as well as communication, documentation, and strong problem-solving skills are required to collaborate with more senior engineers and select information technology areas with minimal supervision.
Lead Vulnerability Engineer:
- Focuses on the detection, prioritization, and remediation of vulnerabilities in accordance with best practices.
- Supports information technology teams in remediating vulnerabilities and provides advanced troubleshooting.
- Leads managing Qualys vulnerability scanning infrastructure to include configuring and scheduling scans, conducting ad-hoc scans, and creating reports.
- Leads managing vulnerability scanning and remediation of GKE container images in GCP.
- Supports file integrity monitoring and OS configuration management compliance processes and works with technology teams on resolving the findings.
- Uses JIRA ticketing system to manage vulnerability lifecycle and tracks SLA breaches.
- Leverages other enterprise tools such as Splunk, BMC Discovery, BMC CMDB, Snow to assist in assessing vulnerabilities and risk and maintaining an accurate asset inventory for complete scan coverage.
- Uses Archer GRC platform to manage vulnerability remediation risk exception process.
- Leads the continuous improvement of the enterprise vulnerability management program.
- Has 7+ years of vulnerability management, systems engineering, or networking experience.
Principal Accountabilities:
- Provides advanced knowledge of best practices and mainly known issues of vulnerability scanning, file integrity monitoring, and the associated services, schedules, and reporting processes with minimal supervision.
- Provides advanced support in evaluation and remediation of mainly known vulnerabilities and known issues with unauthorized change detection. Documents issues, if necessary.
- Defines complex problem statements, gathers and compares data about problems, documents the details, and prepares analysis reports, seeking out all feasible alternatives. Prioritizes the alternatives and works out a plan for execution with minimal supervision.
- Demonstrates advanced understanding of most of the following: Linux/Windows server and application administration and configuration, networking, scripting and automation, large scale distributed computing architecture (client server, cloud, intranet/internet), hardware/operating system/application interaction, and security.
- Collaborates with all levels within the technology division to determine an optimal solution for stakeholders based on mainly known solutions.
- Provides advanced technical advice to other teams within technology on mainly known security solutions.
- Leads in gathering data to assist in setting policies.
- Recommends mainly known alternatives to increase security for application configuration and environment build out for new projects.
- Stays up to date on security trends, vulnerability alerts and advisories.
Skills & Software Requirements:
- Linux/Windows administration and configuration
- Scripting (bash, Powershell)
- Basic networking
- Experience with vulnerability scanning tools (Qualys, Nessus, Rapid7, etc.)
- Familiarity with issue tracking systems (JIRA, Remedy, etc.)
- Familiarity with collaboration tools (Confluence, etc.)
Nice to Have:
- Industry certification (CompTIA Security+, CISSP, CCSP, SSCP, etc.)
- Experience with container scanning technologies
- Experience with vulnerability management in GCP
- Experience with Tripwire
- Java or Python programming experience
- Experience with Splunk, BMC Discovery, Snow, BMC CMDB
#LI-RP1
#LI-Hybrid
CME Group is committed to offering a competitive total rewards package for our employees that recognizes their contributions to the business and reflects our long-term investment in their future. The salary range for this role is $113,600-$189,400. Actual salary offered will be dependent on a wide array of factors including but not limited to: relevant experience, skills, education and comparison to internal employees (where relevant). Our compensation program also includes an annual target bonus opportunity for all employees, as well as the opportunity to become an owner in the company through our broad-based equity program. Through our Benefits program, we strive to offer flexibility, value and choice. From comprehensive health coverage, to a retirement package that includes both a 401(k) and an active Pension Plan, to highly competitive education reimbursement provisions, paid time off and a mental health benefit, CME Group offers a holistic Benefits package for our team and their dependents.
CME Group : Where Futures are Made
CME Group is the world's leading and most diverse derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it - all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we're looking for more.