Cyber Security Engineer II - Purple Team at CME Group Inc Canada

Bengaluru, karnataka, India -

Full Time

Start Date

Immediate

Expiry Date

13 May, 26

Salary

0.0

Posted On

12 Feb, 26

Experience

2 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Cyber Security, Threat Simulation, Red Team, Purple Team, Penetration Testing, MITRE ATT&CK, Scripting, Cloud Environments, Windows Hardening, Linux Hardening, Offensive Security, Incident Investigation, Automation, Vulnerability Assessment, Security Awareness, Technical Reporting

Industry

Financial Services

Description

Role overview We are looking for a Cyber Security Engineer II - Threat Simulation to be an integral part of our Offensive Security organization and contribute towards improving CME Group’s security posture. This role will be responsible for participating in the execution of Purple Team cyber exercises of internal and internet facing information systems and infrastructure. In addition, the role will require participation in Red Team activities to identify misconfigurations and cyber security vulnerabilities that could be exploited by an internal or external actor to gain unauthorized access to computer systems and data. This is a perfect opportunity for the right person to become a key part of a team of highly skilled cybersecurity professionals who execute a pivotal role in protecting and defending national critical infrastructure. Principal Responsibilities Contribute to designing, scoping, and executing Purple Team exercises focused on working with stakeholders to execute relevant tactics, techniques, and procedures to provide information used to improve detections. Contribute to designing, scoping, and executing threat intelligence led Red Team exercises against a hybrid environment using the MITRE ATT&CK Framework. Build and maintain Red and Purple team infrastructure, automating functions where possible. Continually research new offensive security tactics, techniques, and procedures and communicate knowledge of the same to other team members. Conduct ad-hoc offensive security testing using industry standard tools and/or internally developed tools. Contribute to report creation activities including compromise narratives and detailed technical findings with appropriate risk severity ratings, tactical and strategic recommendations to reduce risk levels, peer review of team’s deliverables. Assist cyber defense teams during incident investigations providing subject matter expertise on attacker tradecraft and mindset. Interface with other information security departments, as well as other technology departments and business stakeholders to raise awareness of security issues and to provide knowledge sharing on remediation. Active contributor to Red and Purple Team activities for internal presentations and conferences Position Requirements 3+ years’ experience with industry standard penetration testing tools such as, but not limited to Cobalt Strike, Metasploit, Burp Suite, Nmap, Covenant, etc; or the ability to demonstrate equivalent knowledge. Strong understanding of MITRE ATT&CK framework tactics, techniques and procedures. Strong understanding of Purple Team concepts, tools, and automation strategies. Experience measuring and rating vulnerabilities based on principal characteristics of a vulnerability. Experience with Windows and Linux system hardening concepts and techniques. Experience with at least one scripting language (Python, Ruby, PowerShell, Bash, etc.). Experience with at least one cloud environment (AWS, GCP, Azure). Experience attacking cloud, on-prem and/or hybrid environments from initial access all the way through actions on objective. Nice to have Previous experience of Purple Team project delivery to include creation and execution of Purple Team test plans in collaboration with Blue teams. Experience of using Purple Team automation tools. Experience participating in Red Team engagements. Experience modifying payloads to bypass detections like EDR. Experience of using automated infrastructure provisioning tooling, such as, but not limited to, Terraform. Experience of conducting Offensive Security and/or Purple Team exercises against macOS Understanding of how an Advanced Persistent Threat could compromise a financial institution. Recognized industry certifications such as, but not limited to, GPEN, GXPN, GREM, eCPTX, eCPPT, OSCP, OSWE, CISSP, CPSA, CRT, etc. Knowledgeable in Industry Security standards (i.e.: TIBER-EU, CBEST, NIST Cyber Security Framework, ISO27002, etc.). Experience of working in a sprint driven work environment. CME Group: Where Futures are Made CME Group is the world’s leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career by shaping tomorrow. We invest in your success and you own it – all while working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And we’re looking for more. At CME Group, we embrace our employees' unique experiences and skills to ensure that everyone’s perspectives are acknowledged and valued. As an equal-opportunity employer, we consider all potential employees without regard to any protected characteristic. Important Notice: Recruitment fraud is on the rise, with scammers using misleading promises of job offers and interviews to solicit money and personal information from job seekers. CME Group adheres to established procedures designed to maintain trust, confidence and security throughout our recruitment process. Learn more here. As the world’s leading derivatives marketplace, CME Group is where the world comes to manage risk. We enable clients to trade futures, options, cash and OTC markets, optimize portfolios, and analyze data – empowering market participants worldwide to efficiently manage risk and capture opportunities. CME Group exchanges offer the widest range of global benchmark products across all major asset classes based on interest rates, equity indexes foreign exchange energy agricultural products and metals. We meet uncertainty and volatility with confidence and clarity, across the trading lifecycle and around the world. Hear more about our employee experience Get a look inside CME Group and see what makes us tick A rewarding career is only the beginning Best Place to Work Recruitment fraud is on the rise, with scammers using misleading promises of job offers and interviews to solicit money and personal information from job seekers. CME Group adheres to established procedures designed to maintain trust, confidence and security throughout our recruitment process. Additionally, CME Group does not communicate with job applicants over Telegram. Learn more here. For U.S. employment, CME Group is legally required to validate a new hire’s employment eligibility by having them complete an Employment Eligibility Verification (Form I-9) companied with legally acceptable proof of identity and work authorization (as listed on the Form I-9). CME Group uses E-Verify, which is an online system operated by the U.S. Department of Homeland Security in partnership with the Social Security Administration to verify employment eligibility and validate social security numbers. Through participation in the E-Verify program, information entered on Form I-9 will be provided and compared to information available at both of these agencies. See posters below for more details. E-Verify Notice E-Verify Notice Español U.S. Right to Work Notice U.S. Right to Work Notice Español

How To Apply:

Incase you would like to apply to this job directly from the source, please click here

Responsibilities

The Cyber Security Engineer II will design, scope, and execute Purple Team exercises and Red Team activities to improve security posture. They will also assist in incident investigations and contribute to reporting on vulnerabilities and risk levels.