About the Team:
Security Operations & Engineering protects Morningstar’s corporate environment, products, and the cloud platforms behind them. The group includes two distinct teams: the 24x7 Security Operations Center, and Security Engineering, which this role leads.
Security Engineering owns the tooling that makes detection, response, and prevention possible, including NGAV/EDR, email security, SOAR, detection engineering, and CSPM. Because Morningstar builds its software in house, we also provide the security foundations product development teams build on, such as security scanning in pipelines, hardened container images, and library integrations. We work closely with product engineering and product security teams to make the secure path the easy one, and we focus on the platforms, tooling, and guardrails that let security scale.
The Role:
Lead the Security Engineering team that owns the tooling behind Morningstar’s security program, including endpoint protection, email security, SOAR, detection engineering, and cloud security posture management. You’ll set the team’s priorities, grow its engineers, and make sure the platforms they run give the SOC and the business the visibility, automation, and protection they need. You’ll also guide the shared security foundations that product teams build on, like pipeline scanning, hardened container images, and library integrations. Reporting to the Director of Security Operations & Engineering, you’ll coach your team and stay close enough to the work to help solve difficult technical problems. You’ll have room to shape how engineering and incident response work together, with direct access to security leadership and product development teams.
This on-site role is based in Chicago, IL. It may be filled at the Manager or Senior Manager level, depending on your experience and prior leadership scope. You’ll participate in an infrequent, emergency-only escalation rotation outside normal business hours.
What you’ll be doing:
- Lead and develop security engineers and the incident response lead. Set clear expectations, plan workloads, and support hiring, performance management, and career growth.
- Own the engineering roadmap for detection and security platforms, balancing operational needs with architecture, platform health, and technical debt. The stack includes Splunk, CrowdStrike, Wiz and Wiz Defend, and Zscaler.
- Work with the 24x7 SOC to improve detections and playbooks, automate manual work with XSOAR or Tines, and apply AI where it can improve detection, triage, and response. Track detection quality, automation coverage, and response performance; explain progress and risk to senior leaders.
- Help the incident response lead handle complex investigations and containment. Make sure responders have the tools and support they need, turn lessons learned into engineering improvements, and troubleshoot alongside engineers when they are blocked.
- Partner with product development, cloud platform, and infrastructure teams to strengthen security across AWS, GCP, and Azure while supporting product delivery.
- Integrate automated security checks into product teams’ CI/CD pipelines, including Harness. Help secure agentic and AI-assisted development pipelines, where autonomous tools write, test, and deploy code.
What we’re looking for:
- 4+ years of people management experience, or equivalent technical leadership experience, in security engineering or security operations, with examples of developing people and delivering engineering work.
- Hands-on security engineering knowledge and the ability to troubleshoot complex problems with your team. Experience with SIEM, endpoint detection and response, cloud security posture management, and security automation or orchestration is required; comparable tools are welcome.
- Cloud security experience in a large, multi-cloud environment, ideally including AWS at scale, plus knowledge of incident investigation, containment, and post-incident improvement.
- Sound technical judgment and clear communication with engineers, analysts, and senior leaders, including colleagues in globally distributed teams.
- CI/CD security experience is a plus, including static application security testing (SAST), software composition analysis (SCA), secrets scanning, and infrastructure-as-code (IaC) scanning. CISSP, CISM, or GIAC certifications are welcome, not required
Compensation and Benefits
At Morningstar we believe people are at their best when they are at their healthiest. That’s why we champion your wellness through a wide range of programs that support all stages of your personal and professional life. Here are some examples of the offerings we provide:
Financial Health
100% 401k match up to 6% of salary
Stock Ownership Potential
Company provided life insurance - 1x salary + commission
Physical Health
Comprehensive health benefits (medical/dental/vision) including potential premium discounts and company-provided HSA contributions (up to $500-$2,000 annually) for specific plans and coverages
Additional medical Wellness Incentives - up to $300-$600 annual
Company-provided long- and short-term disability insurance
Emotional Health
Trust-Based Time Off
6-week Paid Sabbatical Program
6-Week Paid Family Caregiving Leave
Competitive 8-24 Week Paid Parental Leave
Adoption Assistance
Leadership Coaching & Formal Mentorship Opportunities
Annual Flex Stipend - $1000 annually to cover personal education & well-being expenses
Tuition Reimbursement
Social Health
Charitable Matching Gifts program
Dollars for Doers volunteer program
Paid volunteering days
15+ Employee Resource & Affinity Groups
Total Cash Compensation Range
$151,975.00-233,025.00Inclusive of annual base salary and target incentive
Morningstar's hybrid work environment gives you the opportunity to collaborate in-person each week as we've found that we're at our best when we're purposely together on a regular basis. In most of our locations, our hybrid work model is four days in-office each week. A range of other benefits are also available to enhance flexibility as needs change. No matter where you are, you'll have tools and resources to engage meaningfully with your global colleagues.
001_MstarInc Morningstar Inc. Legal EntitySkills Required
- 4+ years of people management experience or equivalent technical leadership experience in security engineering or security operations
- Experience developing people and delivering security engineering work
- Hands-on experience with SIEM
- Hands-on experience with endpoint detection and response
- Hands-on experience with cloud security posture management
- Hands-on experience with security automation or orchestration
- Cloud security experience in a large, multi-cloud environment, ideally including AWS at scale
- Knowledge of incident investigation, containment, and post-incident improvement
- Sound technical judgment and clear communication with engineers, analysts, and senior leaders
- CI/CD security experience, including SAST, SCA, secrets scanning, and IaC scanning
- CISSP, CISM, or GIAC certification
What the Team is Saying
Morningstar Compensation & Benefits Highlights
-
Retirement Support — Employer 401(k) matching and access to Morningstar retirement‑planning tools are prominent features of the package. These elements create a strong foundation for long‑term savings.
-
Leave & Time Off Breadth — Flexible time off, paid holidays, sick and personal days, and a paid sabbatical every four years provide generous time away from work. Sabbaticals are specifically highlighted as a standout perk.
-
Parental & Family Support — A global minimum of 16 weeks for primary caregivers, up to eight weeks for secondary caregivers, and at least six weeks of paid caregiving leave offer robust family support. Some materials also note adoption assistance and related resources.
Morningstar Insights
What We Do
We are a global investment research and financial data company with 40-plus offices across North America, Europe, Australia, and Asia. Our products and services are used daily by individual investors, financial advisors, asset managers, retirement plan providers, and institutional investors. We provide data, research, and analysis across managed investment products, publicly listed companies, private capital markets, debt securities, and real-time global market data. The financial system can have real barriers—hidden information, friction that can slow decisions, and forces that can limit transparency and access. We work to remove them, bringing independent research, connected data, and investor-first tools to a system that needs more clarity. The people doing this work span research, technology, design, product, sales, and functional areas. We build many of our products in-house, so the work can connect directly to the tools investors use to make real financial decisions.
Why Work With Us
Morningstar’s missing is to empower investor success. We can only do that if our people feel empowered. That means finding people who think independently, bring a wide range of backgrounds with analytical rigor and genuine intellectual curiosity to the work.
Gallery
Morningstar Teams
Morningstar Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Across most of our offices globally, employees work four days a week in the office and one day from home. We recognize that life doesn't always fit a fixed schedule and offer programs that can help provided increased workplace flexibility.
