Job Title

The Global Information Security (GIS) Technology Risk Management Analyst will work with peers in Global Information Security (GIS) and across the Technology Division to ensure that third party technology risks are properly identified, assessed, monitored, and communicated in support of the overall Third Party Risk Management (TPRM) program. The Analyst will assist with the continuous improvement and daily operation of the GIS Third Party Risk Management (GIS TPRM) program.Responsibilities Include:Work with peers to identify and assess Information Security risksConduct risk assessments using CME Group’s established GIS Third Party Risk Management assessment processCollaboratively author and edit various assessment related documents including Deficiencies Observed, Summary of Work, Risk Advisory Memos, exceptions from GIS technical policies and standards, and other related output resulting from risk adjudication activitiesParticipate in and contribute to various working groups across the Technology Division, including, but not limited to, Third Party Risk Management working group, Governance, Risk Management, and Compliance (GRC) working group, etc.Assist the GIS TPRM function with:Continuous improvement and maturation of the methods, instrumentation, training, documentation, and processes required to properly manage third party technology risksProviding advisory and consulting services to the Information Technology Management Team related to InfoSec risks, treatment strategies, and decision-makingAssist in the preparation of management reports, presentations, metrics, and other documentation required to support governance functionsAssist in compiling and delivering business and operational metrics at regular intervalsPromoting a culture of risk awareness and accountability through training, education, and risk management consultative supportProblem Solving:Objectively assess the impact, likelihood, and velocity of identified risksObjectively advise on any number of controls that will mitigate risk while not imposing undue burden on those who must implement the controlsDrive objectivity and build consensus among stakeholders with widely divergent perspectives and driversRapidly analyze complex technical detailsSynthesize detailed analysis into a “big picture” view that can be easily understood by non-technical stakeholders in order to support risk-based decision-making for senior managers within the companyDecision Making:Recommend risk treatment decisionsRecommend remediation actions when risk mitigation is desiredRecommend improvements to methods, instrumentation, training, documentation, and processesRecommend solutions for automating and streamlining GIS TPRM risk management practicesWorking Relationships:Interacts with peers across all elements of the Technology DivisionCommunicate regularly with cross-functional peers outside of the Technology Division, including Legal, Information Governance, Global Operations, Global Assurance (Internal Audit), Enterprise Risk Management, Third Party Risk Management, and other business unit leadershipInteract occasionally with industry peers from other Systemically Important Financial Market Utilities (SIFMU’s), research organizations, solution providers, etc.Required Experience:Bachelor’s Degree or equivalent experienceMinimum of 1 to 3 years of relevant experience in publicly traded companies or finance/technology industry operations with third party risk management experience a plusExperience in at least two of the following: InfoSec (Operations, Program Management, Governance, Risk Management, etc.), Enterprise Architecture, Identity & Access Management, Application Development, Infrastructure & Operations, IT Compliance, or Internal AuditExperience working with industry based information security and / or control frameworks (NIST Cyber Security Framework, ISO 27002, COBIT, etc.)Demonstrable knowledge of a broad range of InfoSec technologies and practicesDemonstrable, impeccable writing skills for technical, management, and executive audiencesAdditional preferred experience:Demonstrable knowledge of InfoSec risk management methods and practicesExperience with operating GRC solutionsProfessional certification in InfoSec or Risk Management (such as CRISC, CISM, CISSP, CGEIT, CISA, etc.)