Sr Manager, Cyber Defense

Department Overview

• McDonald’s new growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omnichannel restaurant brand. As the consumer landscape shifts, we are using our competitive advantages to strengthen our brand further. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital, and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive-Thrus, through McDelivery, dine-in, or takeaway.
• McDonald’s Global Technology organization is leading this tech revolution, comprised of intrapreneurs who get to build cool tech with scary intelligent people using the latest innovations like AI, IoT, and edge computing. We do this by working with diverse, global teams who are always hungry for a challenge. It’s bonus points when you see your family and friends use the tech you build at their favorite McD restaurant.
• As we have matured as an engineering organization and seen the demands for technology grow exponentially, we’re gearing up to deliver on the next set of opportunities for the business. We are building up an in-house engineering team accountable for our strategic products, working alongside diverse squads of internal engineers and partners to solve technology innovation challenges at an incredible scale.

Duties

• Security Operations & Service Delivery (UK / EMEA)
  • Lead the UK-based SOC team delivering monitoring, triage, investigation, and escalation across the EMEA timezone within the follow-the-sun GSOC model, owning the UK shift and ensuring clean handovers with the US and India locations.
  • Manage the end-to-end lifecycle of EMEA security events — from detection through investigation and escalation to Incident Response (CIRT) to closure — in line with defined SLOs and KPIs, coordinating with market security and technology teams.
• Detection & Response Operations
  • Identify and investigate intrusions and drive effective response using SIEM, SOAR, EDR/XDR, and email security solutions, supporting threat hunting and developing remediation plans across EMEA markets.
  • Provide detection tuning and feedback loops to Detection Engineering and managed providers, and coordinate with CIRT and Cyber Threat Intelligence on handoffs and IOC enrichment.
• People Leadership & Team Development
  • Lead, mentor, and develop the UK team of analysts — managing shift scheduling, capacity, and performance while providing hands-on technical guidance to mature their tradecraft and response capabilities.
• Metrics, Reporting & Program Maturity
  • Be accountable for UK SOC metrics (MTTD, MTTR, MTTC, case backlog) and translate operational data into executive-ready narratives, driving continuous improvement of the SOC.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.
• 6+ years of experience in cybersecurity operations, security monitoring, detection and response, or IT security incident management.
• Demonstrated experience leading or supervising SOC teams, including direct people management, coaching, and performance management.
• Deep technical understanding of SIEM platforms, SOAR orchestration, EDR/XDR solutions, log management, and security event investigation workflows.
• Expert-level understanding of security monitoring, alert triage methodologies, incident escalation frameworks, and the cyber kill chain.
• In-depth understanding and practical application of the NIST Cybersecurity Framework.
• Strong experience working with a SOC/NOC and coordinating with legal and market operations during incidents.
• Strong communication and stakeholder management skills, with the ability to translate operational data and security events into business risk language.
• Proven ability to operate under pressure, manage competing priorities, and lead teams through high-stress incident response situations.
• Willingness and ability to work non-standard hours, including nights, weekends, and holidays, in support of active incident response and global SOC coverage requirements.
• Professional certifications such as CISSP, CISM, GCIH, GCIA, GCFA, GREM, OSCP, or equivalent.
• Experience with Google SecOps/Azure Sentinel, Defender/SentinelOne/CrowdStrike, or comparable SIEM/EDR platforms at enterprise scale.
• Outstanding technical w…