Senior Security Engineer
- London, England, Großbritannien
- Festanstellung, Vollzeit
- Chicago Mercantile Exchange
- 20 Mär 19
Senior Security Engineer
CME Group is the world's leading and most diverse derivatives marketplace. But who we are goes deeper than that. Here, you can impact markets worldwide. Transform industries. And build a career shaping tomorrow. We invest in your success and you own it, all while working alongside a team of leading experts who inspire you in ways big and small. Joining our company gives you the opportunity to make a difference in global financial markets every day, whether you work on our industry-leading technology and risk management services, our benchmark products or in a corporate services area that helps us serve our customers better. We're small enough for you and your contributions to be known. But big enough for your ideas to make an impact. The pace is dynamic, the work is unlike any other firm in the business, and the possibilities are endless. Problem solvers, difference makers, trailblazers. Those are our people. And we're looking for more.
To learn more about what a career at CME Group can offer you, visit us at www.wherefuturesaremade.com .
Senior Security Engineer
The Senior Engineer is responsible for providing leadership on security subject matter through design & delivery of integrated solution architectures and development of standards and reference architectures. By adding your experience and extensive knowledge on multiple technologies and solutions to the team's collective skills and experience we further enhance our ability to provide secure technical design recommendations that target on delivering business value through successful project and program delivery.
The Senior Security Engineer will participate in all functions related to Security Architecture, including: application security strategy and roadmap planning, acting as a security liaison to the business, and help facilitate demand management.
This role requires a high level of technical expertise in multiple disciplines within Information Security, including: networking, virtualization, identity and access management (IAM), directory services (LDAP/AD), cloud computing (AWS, GCP, Azure), databases, basic understanding of security and regulatory frameworks (CIS, NIST, RegSCI, HIPAA, etc.), exposure to security stack technologies (IDS/IPS, SIEM, etc.) among other disciplines. In addition to technical prowess, the role will require mentorship, design guidance, and consultation to drive change and support the evolution of CME Group.
Additionally, the individual will provide design support and security best practice guidance, in the form of consultation, to various development teams and business stakeholders. The individual is also responsible for performing application architecture security reviews and championing security through design and delivery of integrated solution architectures.
- This role will actively lead the creation and updating of standards and reference architectures. Standards may be required for CME Group to comply with regulatory requirements set forth by various regulatory bodies that provide oversight to CME Group business functions. Reference architectures provide direction and guidance on proper compliance with these defined standards. While performing architecture assessments, decisions on threat modelling and proper service design, structure, and implementation will be required.
- Communicate and collaborate with cross-functional peers outside of the Technology Division, including General Counsel, Records Retention, Global Assurance, Enterprise Risk Management, Third Party Risk Management, and other business unit leadership.
- Lead infrastructure security assessments and assist in planning the remediation of assessment, audit, and regulatory findings.
- Participate in and contribute to key working groups across the enterprise, including but not limited to: Architecture Review Board and/or change advisory boards. Prepare reports for senior management including presentations, metrics, and other documentation required to support governance functions.
- Continuous improvement and maturation of the methods, instrumentation, training, documentation, and processes required to properly assess and govern Infrastructure architecture and the software development lifecycle.
- This role will influence and collaborate regularly with various peers via steering committees, standards and policy governance teams and other group settings that formulate CME Group security policies, standards, and reference architectures. This role will lead formation of policies, standards, reference architectures, process and procedures as they relate to infrastructure architecture at CME Group.
- Providing consulting services at critical points in the SDLC.
- Demonstrable experience as an enterprise and/or security architect within finance/technology industry
- Experience with or deep exposure to the financial industry, focused on clearing or trading
- Demonstrable knowledge of a broad range of Information Security technologies and practices
- Demonstrable, impeccable writing skills for technical, management, and executive audiences
- Demonstrable communication capabilities including oral presentation and ability to present in front of executive leadership
- Demonstrable experience coordinating multiple concurrent issues, in high-pressure situations
- Experience of security analysis, design and service development
- Advanced knowledge of application security assessments
- Experience with application interdependency and infrastructural design
- Experience with scripting languages
- Experience with drafting of standard, reference architecture, policies, procedures and implementation guidelines
- Extensive experience with the Build Security in Maturity Model (BSIMM) methodology and assessment process
- High understanding of entire software development process, including specification, documentation and quality assurance
- High degree of understanding in the theories, methodologies and principals underlying secure technical analysis, design and implementation of secure networks, applications, systems, and databases
- Relevant experience designing, implementing, and supporting large scale solutions
- High degree of understanding with Cryptographic Services
- Experience with Amazon Web Services and Microsoft Azure
- A Bachelor's or Master's degree in Computer Science, Information Systems or other related discipline is required; or equivalent combination of education and relevant proven work experience.
- CISSP, GWAPT, OSCP/OSCE/OSWE or other relevant certifications
- Opening date - 15 March 2019
- Closing date - 12 April 2019
- Salary - Competitive
- Location - One New Change, London, EC4M 9AF