CME Group Lead Application Security Architect provides leadership on security subject matter through design & delivery of integrated solution architectures and development of standards and reference architectures. By adding your experience and extensive knowledge on multiple technologies and solutions to the team's collective skills and experience we further enhance our ability to provide secure technical design recommendations that target on delivering business value through successful project and program delivery.
The Lead Architect position will participate in all functions related to Application Security Architecture, including: application security strategy and roadmap planning, acting as a security liaison to the business, and help facilitate demand management.
This role requires a high level of technical expertise in multiple disciplines within Software Development and Application Security, including: support and maturation of a Secure Software Development Lifecycle (secure SDLC), contribution to or review of blackbox/greybox/whitebox security assessments, providing application design support and guidance to development teams for legacy and new development, contribute to writing process/standards/guidelines/reference architectures to contribute to corporate software security maturity, cloud computing (AWS, Google Cloud Platform, Azure), databases, basic understanding of security and regulatory frameworks (CIS, NIST, RegSCI, HIPAA, etc.), exposure to security stack technologies (IDS/IPS, SIEM, etc.) among other disciplines.
In addition to technical prowess, the role will require mentorship, design guidance, and consultation to drive change and support the evolution of CME Group.
As a leader on the Global Information Security team (GIS), the incumbent is expected to remain engaged with and support other leaders across GIS and Technology to ensure the timely delivery of security and business solutions.
• This role will actively lead the creation and updating of standards and reference architectures. Standards may be required for CME Group to comply with regulatory requirements set forth by various regulatory bodies that provide oversight to CME Group business functions. Reference architectures provide direction and guidance on proper compliance with these defined standards. While performing application architecture assessments, decisions on threat modeling and proper service design, structure, and implementation will be required.
• This role will help forecast demand for Application Security Architecture services by meeting with CME business units to better understand their needs. This role will also help determine necessary resource levels to support those business units' needs.
• Communicate and collaborate with cross-functional peers outside of the Technology Division, including General Counsel, Records Retention, Global Assurance, Enterprise Risk Management, Third Party Risk Management, and other business unit leadership.
• Drive objectivity and build consensus among internal and external stakeholders with widely divergent perspectives and drivers.
• Interact with industry peers from other systemically important financial market utility (SIFMU) organizations, research organizations, solution providers, etc.
• Lead application security assessments and assist in planning the remediation of assessment, audit, and regulatory findings.
• Participate in and contribute to key working groups across the enterprise, including but not limited to: Architecture Review Board and/or change advisory boards. Prepare reports for senior management including presentations, metrics, and other documentation required to support governance functions.
• Continuous improvement and maturation of the methods, instrumentation, training, documentation, and processes required to properly assess and govern application architecture and the software development lifecycle.
• Participate in development of the security roadmap, and communicate GIS' vision to business partners and IT staff
• Actively participates in Communities of Practice to ensure effective adoption of security and continuous improvement of security efforts
• Act as an advocate for security and lead efforts to promote security awareness at all levels of the organizations
• Ensure that all risk considerations are identified and addressed with new and modified services
• Monitor and enhance secure architecture standards within the Software Development Lifecycle
• Identify and establish core architectural mechanisms to enhance the security of services
• Support larger architectural projects while leading internal projects
• Perform application security architectural assessments
• Provide consultation on secure application design
This role will influence and collaborate regularly with various peers via steering committees, standards and policy governance teams and other group settings that formulate CME Group security policies, standards, and reference architectures. This role will lead formation of policies, standards, reference architectures, process and procedures as they relate to application security architecture at CME Group.
A Bachelor's or Master's degree in Computer Science, Information Systems or other related field; or equivalent work experience.
• 5+ years of experience providing enterprise and/or security architecture support in publicly traded companies or finance/technology industry; or minimum 5 years as a consultant to such companies at a commensurate level.
• Experience with or deep exposure to the financial industry, focused on clearing or trading
• Demonstrable knowledge of a broad range of Information Security technologies and practices
• Demonstrable, impeccable writing skills for technical, management, and executive audiences
• Demonstrable communication capabilities including oral presentation and ability to present in front of executive leadership
• Demonstrable experience coordinating multiple concurrent issues, in high-pressure situations
• 7+ years of security analysis, design and service development OR demonstrated ability to meet job requirements through a comparable number of years of technical work experience
• Advanced knowledge of application security assessments
• 3+ years performing reviews of application architectures for security vulnerabilities and threat modeling
• Experience with application interdependency and application design/design patterns
• Experience with scripting languages
• Experience with drafting of standard, reference architecture, policies, procedures and implementation guidelines
• Extensive experience with the Build Security In Maturity Model (BSIMM) methodology and assessment process
• High understanding of entire development process, including specification, documentation and quality assurance
• High degree of understanding in the theories, methodologies and principals underlying secure technical analysis, design and implementation of secure networks, applications, systems, and databases
• Candidates must have proven ability to build value propositions, business cases, & drive results as part of a larger project or program team
• Relevant experience designing, implementing, and supporting large scale solutions
• High degree of understanding with Cryptographic Services
• Experience with Amazon Web Services, Microsoft Azure and other internal and external cloud providers.
• Preferred: one or more certifications, including: GSEC, CISSP, CISA, GIAC, GPEN, PMP, MCSE, GCIA, GCIH, CSSLP
CME Group: Where Futures Are Made