IT Compliance & Controls Analyst II

Description  The IT Compliance/Controls Analyst II is a pivotal role within the Global Information Security (GIS) department, dedicated to advancing IT governance and managing organizational risk. This position ensures the robust implementation and operational effectiveness of critical IT controls. A primary focus is maintaining rigorous compliance with key global regulatory and assurance obligations, including but not limited to CFTC, SEC, Fedline Assurance, and SWIFT CSP, for independent effective challenge and minimize corporate risk. The incumbent will conduct comprehensive security risk assessments, with a specialized emphasis on evaluating AI/ML deployments and frontier model concepts. Furthermore, the role involves driving automated AI-based risk and compliance initiatives to keep the organization at the forefront of technological and process evolution. Primary Accountabilities Internalize and contribute to the strategic goals of the CME Group Technology Compliance Team. Maintain expert knowledge of the company’s IT infrastructure, applications, and governance standards. Execute control assessments to verify the adequacy of internal controls and adherence to corporate policies. Conduct comprehensive security risk assessments to preemptively address audit findings and reduce risk. Evaluate security risks associated with AI/ML deployments and emerging frontier model technologies. Lead forward-looking AI-driven risk initiatives to ensure continuous alignment with regulatory advancements. Design and implement Python-based control automation pipelines, integrating with enterprise APIs (Archer GRC, CyberArk, AD, HashiCorp Vault) for programmatic evidence validation. Ensure strict compliance with regulatory obligations, including CFTC, Fedline, and SWIFT CSP frameworks. Produce detailed, logical work-papers documenting testing procedures, results, and expert conclusions. Streamline control testing and risk processes utilizing automation and AI tools (e.g., Python, Gemini). Foster collaborative relationships with stakeholders to enhance the efficiency of the controls testing program. Key responsibilities include Test internal technology controls in alignment with global regulatory requirements. Develop and recommend strategic remediation plans for identified control gaps. Identify opportunities for automation within IT control and risk assessment workflows. Provide regular status reporting and assist in the development of performance metrics for senior leadership. Partner with senior team members to advise management on strengthening controls and mitigating risks. Assess existing controls against evolving industry best practices and legal obligations. Execute standard lifecycle security risk assessments across diverse technical domains. Proactively identify and mitigate risks associated with emerging AI/ML technologies and frontier models. Support the establishment and refinement of compliance frameworks for AI applications. Maintain strict alignment with global regulatory standards in all remediation and testing activities.   The incumbent will collaborate with key partners such as IT Control Owners, Corporate Compliance, Business Process Owners and Global Assurance (i.e. Internal Audit) with supporting and establishing new approaches or changes in existing processes around documented requirements for mitigation of associated risks.  Given the current control environment, precedents will need to be established to determine how to properly respond, leveraging defined controls but continuing to establish a policy reflecting a culture of compliance.

Bachelor’s degree in Computer Science, Information Systems, Finance, or a related technical field. 2+ years of experience in IT audit, risk advisory, or information security within a financial or professional services firm. Professional certification highly desirable (CISA, CISSP, CRISC, or ISO 27001). Experience in technical aspects of IT Risk Management,