Sr Manager, Cyber Defense

Company Description:

McDonald’s growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omni-channel restaurant brand. As the consumer landscape shifts we are using our competitive advantages to further strengthen our brand. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive thrus, through McDelivery, dine-in or takeaway.

McDonald’s Global Technology is here to power tomorrow’s feel-good moments.

That’s why you’ll find us at the forefront of transformative technology, exploring new and innovative ways to serve our millions of customers and spread happiness one delicious Hot Fudge Sundae-dipped fry at a time. Using AI, robotics and emerging tech, we’re digitizing the Golden Arches. Combine that with our unparalleled global scale, and we’re reshaping all areas of the business, industry and every community that is home to a McDonald’s restaurant. We face complex tech challenges every day. But that’s where our diverse and talented teams come in. They’re made up of the best and brightest from all over the globe, and they thrive in the space where feel-good meets fast-paced.

Check out the McDonald’s Global Technology Technical Blog to learn how technology and our global team are directly enabling the Accelerating the Arches strategy.

Department Overview

McDonald’s is seeking a Senior Manager, Detection Engineering to lead the team responsible for developing, validating, and maintaining threat detections across our global technology environment.

You will own the detection engineering roadmap and day-to-day delivery, translating threat intelligence, incident findings, offensive security results, and business risk into prioritized engineering work. You will develop the team, establish engineering standards, and ensure detections remain effective as our technology and threat landscape evolve.

This role requires a technically credible people leader. You should be comfortable reviewing detection logic, investigating telemetry gaps, challenging technical assumptions, and contributing directly to complex engineering problems while enabling the team to deliver independently.

You will work closely with Security Operations, Incident Response, Cyber Threat Intelligence, Offensive Security, and platform owners to improve our ability to identify and investigate threats across corporate and market environments.

Responsibilities

Lead the team and delivery

• Manage and develop detection engineers through hiring, coaching, performance management, and career development.
• Own the detection engineering roadmap, prioritized backlog, and delivery commitments. Make tradeoffs explicit when risk, capacity, and technical dependencies compete.
• Establish clear responsibilities and working agreements with partner teams for telemetry onboarding, detection deployment, alert triage, and remediation. • Communicate detection gaps, delivery risks, and resource needs to security leadership with actionable recommendations.

Own the detection lifecycle

• Lead the design, development, testing, deployment, tuning, and retirement of detection content across relevant security platforms.
• Establish detection-as-code practices, including version control, peer review, automated testing, controlled deployment, and rollback.
• Ensure detections include documented behavior, required telemetry, validation evidence, known limitations, and investigation guidance.
• Maintain visibility into detection health, including failures caused by changes to data sources, schemas, configurations, or adversary behavior.

Improve coverage and validate effectiveness

• Prioritize detection opportunities using relevant adversary techniques, threat intelligence, incident lessons, and the criticality of affected systems.
• Partner with technology owners to close telemetry gaps and improve the quality and availability of security data.
• Work with Offensive Security, Threat Intel, and Incident Response teams to validate detections through controlled testing and turn findings into engineering improvements.
• Translate threat-hunting findings into maintained detection content and identify opportunities for automation.
• Measure and report detection effectiveness through validated coverage, alert quality, telemetry health, and time to close priority gaps. Distinguish documented coverage from demonstrated detection capability.

Qualifications

Minimum qualifications

• Demonstrated experience developing and operating production detections, with depth in detection engineering and relevant experience in threat hunting, incident response, or security operations.
• Experience directly managing technical security staff, including coaching, performance management, and delivery accountability.
• Strong technical judgment in detection logic, adversary behavior, and the telemetry needed to identify malicious activity.
• Hands-on experience with SIEM and endpoint security platforms, detection query languages, and scripting or programming for security automation.
• Experience applying software engineering practices to security content, including version control, testing, and peer review.
• Ability to apply MITRE ATT&CK to prioritize and validate detections while recognizing the limitations of framework-based coverage measures.
• Ability to coordinate delivery across teams and explain technical gaps, risk, and tradeoffs to both technical and nontechnical stakeholders.
• Bachelor’s degree in a relevant field or equivalent practical experience.

Preferred qualifications

• Experience delivering detection capabilities in a large, distributed enterprise with multiple markets or business units.
• Experience with cloud, identity, endpoint, network, and application telemetry.
• Experience building automated detection validation and integrating adversary emulation or purple-team exercises into engineering workflows.
• Experience managing dependencies and delivery expectations with external security service providers.
• Experience evaluating analytics and AI-assisted security capabilities through measurable operational outcomes.

Compensation

Bonus Eligible: YES

Long - Term Incentive: YES

Benefits Eligible: YES

Salary Range

The expected salary range for this role is $167,366.00 - $209,207.00 per year

The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we may also consider your experience, and other job-related factors.

Additional Information:

Benefits eligible: This position offers health and welfare benefits, including but not limited to comprehensive health insurance, which includes medical, prescription drug, mental health, dental and vision coverage, as well as, life insurance.

Bonus eligible: This position is eligible for a bonus, calculated based on individual and company performance.

Long term Incentive eligible: This position is eligible for stock or other equity grants pursuant to McDonald’s long-term incentive plan.

McDonald’s is an equal opportunity employer. We promote an inclusive work environment that creates feel-good moments for everyone. McDonald’s provides reasonable accommodations to qualified individuals with disabilities as part of the application or hiring process or to perform the essential functions of their job. If you need assistance accessing or reading this job posting or otherwise feel you need an accommodation during the application or hiring process, please contact [email protected]. Reasonable accommodations will be determined on a case-by-case basis.

McDonald’s provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to sex, sex stereotyping, pregnancy (including pregnancy, childbirth, and medical conditions related to pregnancy, childbirth, or breastfeeding), race, color, religion, ancestry or national origin, age, disability status, medical condition, marital status, sexual orientation, gender, gender identity, gender expression, transgender status, protected military or veteran status, citizenship status, genetic information, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Nothing in this job posting or description should be construed as an offer or guarantee of employment.