Senior Vulnerability Engineer

Job Description

DescriptionSr Security Engineer - Vulnerability Mitigation is knowledgeable and provides support for detection, assessment, communication, and remediation coordination of security vulnerabilities, as well as support for file integrity monitoring and OS configuration managementcompliance. The incumbent must have knowledge of Linux/Windows server and application administration and configuration, networking, scripting and automation, distributed computing, cloud technologies, and security. Ability to work independently as well ascommunication, documentation, and strong problem-solving skills are required to collaborate with more senior engineers and select information technology areas, with some supervision. The Sr Security Engineer - Vulnerability Mitigation:

• Focuses on the detection, prioritization, and remediation of vulnerabilities in accordance with best practices.
• Supports information technology teams in remediating vulnerabilities and provides advanced troubleshooting.
• Assists with managing Qualys vulnerability scanning infrastructure to include configuring and scheduling scans, conducting ad-hoc scans, and creating reports.
• Assists with managing vulnerability scanning and remediation of GKE container images in GCP.
• Supports file integrity monitoring and OS configuration management compliance processes and works with technology teams on resolving the findings.
• Uses JIRA ticketing system to manage vulnerability lifecycle and tracks SLA breaches.
• Leverages other enterprise tools such as Splunk, BMC Discovery, BMC CMDB, Snow to assist in assessing vulnerabilities and risk and maintaining an accurate asset inventory for complete scan coverage.
• Uses Archer GRC platform to manage vulnerability remediation risk exception process.
• Participates in the continuous improvement of the enterprise vulnerability management program.
• Has 5+ years of vulnerability management, systems engineering, or networking experience.

Principal Accountabilities :

• Provides knowledge of best practices and mainly known issues of vulnerability scanning, file integrity monitoring, and the associated services, schedules, and reporting processes with some supervision.
• Provides support in evaluation and remediation of mainly known vulnerabilities and known issues with unauthorized change detection. Documents issues, if necessary.
• Accurately defines problem statements of above average complexity. Gathers and compares data about problems, documents the details, and prepares analysis reports, seeking out all feasible alternatives. Prioritizes the alternatives and works out a plan forexecution with some supervision.
• Demonstrates understanding of most of the following: Linux/Windows server and application administration and configuration, networking, scripting and automation, large scale distributed computing architecture (client server, cloud, intranet/internet), hardware/operatingsystem/application interaction, and security.
• Collaborates with other teams within the technology division to determine an optimal solution for stakeholders based on mainly known solutions.
• Provides technical advice to other teams within technology on mainly known security solutions.
• Supports more senior engineers in gathering data to assist in setting policies.
• Recommends mainly known alternatives to increase security for application configuration and environment build out for new projects.
• Stays up to date on security trends, vulnerability alerts and advisories.

Skills & Software Requirements :

• Linux/Windows administration and configuration
• Scripting (bash, Powershell)
• Basic networking
• Experience with vulnerability scanning tools (Qualys, Nessus, Rapid7, etc.)
• Familiarity with issue tracking systems (JIRA, Remedy, etc.)
• Familiarity with collaboration tools (Confluence, etc.)

Nice to Have :

• Industry certification (CompTIA Security+, CISSP, CCSP, SSCP, etc.)
• Experience with container scanning technologies
• Experience with vulnerability management in GCP
• Experience with Tripwire
• Java or Python programming experience
• Experience with Splunk, BMC Discovery, Snow, BMC CMDB

CME Group: Where Futures Are Made CME Group (www.cmegroup.com) is the worlds leading derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career shaping tomorrow. We invest in your success and you own it, allwhile working alongside a team of leading experts who inspire you in ways big and small. Problem solvers, difference makers, trailblazers. Those are our people. And were looking for more. At CME Group, we embrace our employees diverse experiences, cultures and skills, and work to ensure that everyones perspectives are acknowledged and valued. As an equal opportunity employer, we recognize the importance of a diverse and inclusive workplaceand consider all potential employees without regard to any protected characteristic. The Candidate Privacy Policy can be found here.