Sr Manager, Cyber Defense

Company Description

McDonald’s is proud to be one of the most recognized brands in the world, with restaurants in over 100 countries that serve 70 million customers daily. As the global leader in the food service industry, our legacy of innovation and hard work continues to drive us.

From drive thru updates to delivery to mobile order and pay, we are innovating quickly and growing. Joining McDonald's means thinking big and preparing for a career that can have influence around the world.

Department Overview

• McDonald’s new growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omnichannel restaurant brand. As the consumer landscape shifts, we are using our competitive advantages to strengthen our brand further. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital, and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive-Thrus, through McDelivery, dine-in, or takeaway.
• McDonald’s Global Technology organization is leading this tech revolution, comprised of intrapreneurs who get to build cool tech with scary intelligent people using the latest innovations like AI, IoT, and edge computing. We do this by working with diverse, global teams who are always hungry for a challenge. It’s bonus points when you see your family and friends use the tech you build at their favorite McD restaurant.
• As we have matured as an engineering organization and seen the demands for technology grow exponentially, we’re gearing up to deliver on the next set of opportunities for the business. We are building up an in-house engineering team accountable for our strategic products, working alongside diverse squads of internal engineers and partners to solve technology innovation challenges at an incredible scale.

Duties

• Security Operations & Service Delivery (UK / EMEA)
  • Lead the UK-based SOC team delivering monitoring, triage, investigation, and escalation across the EMEA timezone within the follow-the-sun GSOC model, owning the UK shift and ensuring clean handovers with the US and India locations.
  • Manage the end-to-end lifecycle of EMEA security events - from detection through investigation and escalation to Incident Response (CIRT) to closure - in line with defined SLOs and KPIs, coordinating with market security and technology teams.
• Detection & Response Operations
  • Identify and investigate intrusions and drive effective response using SIEM, SOAR, EDR/XDR, and email security solutions, supporting threat hunting and developing remediation plans across EMEA markets.
  • Provide detection tuning and feedback loops to Detection Engineering and managed providers, and coordinate with CIRT and Cyber Threat Intelligence on handoffs and IOC enrichment.
• People Leadership & Team Development
  • Lead, mentor, and develop the UK team of analysts - managing shift scheduling, capacity, and performance while providing hands-on technical guidance to mature their tradecraft and response capabilities.
• Metrics, Reporting & Program Maturity
  • Be accountable for UK SOC metrics (MTTD, MTTR, MTTC, case backlog) and translate operational data into executive-ready narratives, driving continuous improvement of the SOC.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.
• 6+ years of experience in cybersecurity operations, security monitoring, detection and response, or IT security incident management.
• Demonstrated experience leading or supervising SOC teams, including direct people management, coaching, and performance management.
• Deep technical understanding of SIEM platforms, SOAR orchestration, EDR/XDR solutions, log management, and security event investigation workflows.
• Expert-level understanding of security monitoring, alert triage methodologies, incident escalation frameworks, and the cyber kill chain.
• In-depth understanding and practical application of the NIST Cybersecurity Framework.
• Strong experience working with a SOC/NOC and coordinating with legal and market operations during incidents.
• Strong communication and stakeholder management skills, with the ability to translate operational data and security events into business risk language.
• Proven ability to operate under pressure, manage competing priorities, and lead teams through high-stress incident response situations.
• Willingness and ability to work non-standard hours, including nights, weekends, and holidays, in support of active incident response and global SOC coverage requirements.
• Professional certifications such as CISSP, CISM, GCIH, GCIA, GCFA, GREM, OSCP, or equivalent.
• Experience with Google SecOps/Azure Sentinel, Defender/SentinelOne/CrowdStrike, or comparable SIEM/EDR platforms at enterprise scale.
• Outstanding technical writing skills and the ability to communicate to diverse audiences.

Additional information

At McDonalds we are People from all Walks of Life...

People are at the heart of everything we do, and they make the McDonalds experience. We embrace diversity and are committed to creating an inclusive culture that means people can be their best authentic self in our restaurants and offices, which helps us to better serve our customers. We have a strong heritage of diversity and representation within our communities, which we are proud of. The diversity of our people, customers, Franchisees, and suppliers gives us strength.

We do not tolerate inequality, injustice, or discrimination of any kind. These are hugely important issues and a brand with our reach and relevance means we have a very meaningful role to play.

We also recognise our responsibility as a large employer to continue being active in our communities, helping to develop skills and drive aspirations that will help people to be more aware of the world of work and more successful within it, whether with McDonalds or elsewhere.