Cyber Security Engineer III - Threat Simulation

Job Description

DescriptionRole overviewWe are looking for a Cyber Security Engineer III - Threat Simulationto be an integral part of our Offensive Security organization and contribute towards improving CME Groups security posture. This role will be responsible for participating in the execution of Purple Team cyber exercises of internal and internet facing information systems and infrastructure. In addition, the role will require participation in Red Team activities to identify misconfigurationsand cyber security vulnerabilities that could be exploited by an internal or external actor to gain unauthorized access to computer systems and data. This is a perfect opportunity for the right person to become a key part of a team of highly skilled cybersecurity professionals who execute a pivotal role in protecting and defending national critical infrastructure. Principal Responsibilities

• Contribute to designing, scoping, and executing Purple Team exercises focused on working with stakeholders to execute relevant tactics, techniques, and procedures to provide information used to improve detections.
• Contribute to designing, scoping, and executing threat intelligence led Red Team exercises against a hybrid environment using the MITRE ATT&CK Framework.
• Build and maintain Red and Purple team infrastructure, automating functions where possible.
• Continually research new offensive security tactics, techniques, and procedures and communicate knowledge of the same to other team members.

• Conduct ad-hoc offensive security testing using industry standard tools and/or internally developed tools.
• Contribute to report creation activities including compromise narratives and detailed technical findings with appropriate risk severity ratings, tactical and strategic recommendations to reduce risk levels, peer review of teams deliverables.
• Assist cyber defense teams during incident investigations providing subject matter expertise on attacker tradecraft and mindset.

• Interface with other information security departments, as well as other technology departments and business stakeholders to raise awareness of security issues and to provide knowledge sharing on remediation.
• Active contributor to Red and Purple Team activities for internal presentations and conferences

Position Requirements

• 5+ years experience with industry standard penetration testing tools (Cobalt Strike, Metasploit, Burp Suite, Nmap, Covenant, etc.); or the ability to demonstrate equivalent knowledge.
• Strong understanding of MITRE ATT&CK framework tactics, techniques and procedures.
• Strong understanding of Purple Team concepts, tools, and automation strategies.

• Strong understanding of measuring and rating vulnerabilities based on principal characteristics of a vulnerability.
• Strong understanding of Windows and Linux system hardening concepts and techniques.
• Experience with at least one scripting language (Python, Ruby, PowerShell, Bash, etc.).

• Experience with at least one cloud environment (AWS, GCP, Azure).
• Experience modifying payloads to bypass detections like EDR.
• Experience attacking cloud, on-prem and/or hybrid environments from initial access all the way through actions on objective.

Nice to have

• Previous experience of Purple Team project delivery to include creation and execution of Purple Team test plans in collaboration with Blue teams.
• Experience of using Purple Team automation tools.
• Experience of using automated configuration management such as Chef.
• Experience of conducting Offensive Security and/or Purple Team exercises against macOS and ChromeOS.
• Understanding of how an Advanced Persistent Threat could compromise a financial institution.
• Recognized industry certifications such as, but not limited to, GPEN, GXPN, GREM, eCPTX, eCPPT, OSCP, OSWE, CISSP, CPSA, CRT, etc.
• Knowledgeable in Industry Security standards (i.e.: TIBER-EU, CBEST, NIST Cyber Security Framework, ISO27002, etc.).
• Knowledgeable in Agile project management.

Company Benefits

• Bonus Programme
• Equity Programme
• Employee Stock Purchase Plan (ESPP)
• Private Medical and Dental coverage
• Mental Health Benefit Programme
• Group Pension Plan
• Income Protection
• Life Assurance
• Cycle To Work
• Gym Membership
• Family Leave
• Education Assistance - MBA/Advanced Degree/Bachelor Degree
• Ongoing Employee Development Training/Certification
• Hybrid Working

#LI-RK2 #LI-Hybrid #nijobs.com CME Group: Where Futures Are Made CME Group (www.cmegroup.com) is the worlds leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career shaping tomorrow. We invest in your success and you own it, allwhile working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And were looking for more. At CME Group, we embrace our employees diverse experiences, cultures and skills, and work to ensure that everyones perspectives are acknowledged and valued. As an equal opportunity employer, we recognize the importance of a diverse and inclusive workplaceand consider all potential employees without regard to any protected characteristic. The Candidate Privacy Policy can be found here.