Sr Manager, Cyber Defense

McDonald's Corporation • Chicago, IL

1d • $167,366 - $209,207

About The Position

McDonald’s is seeking a senior technical people leader to lead the team responsible for developing, validating, and maintaining threat detections across its global technology environment. The role owns the detection engineering roadmap and day-to-day delivery, translating threat intelligence, incident findings, offensive security results, and business risk into prioritized engineering work. The successful candidate will develop the team, establish engineering standards, and ensure detections remain effective as the company’s technology and threat landscape evolve.

The role calls for a technically credible leader who can review detection logic, investigate telemetry gaps, challenge technical assumptions, and contribute to complex engineering problems while enabling the team to deliver independently. The position works closely with Security Operations, Incident Response, Cyber Threat Intelligence, Offensive Security, and platform owners to improve threat identification and investigation across corporate and market environments.

Requirements

• Demonstrated experience developing and operating production detections, with depth in detection engineering and relevant experience in threat hunting, incident response, or security operations.
• Experience directly managing technical security staff, including coaching, performance management, and delivery accountability.
• Strong technical judgment in detection logic, adversary behavior, and the telemetry needed to identify malicious activity.
• Hands-on experience with SIEM and endpoint security platforms, detection query languages, and scripting or programming for security automation.
• Experience applying software engineering practices to security content, including version control, testing, and peer review.
• Ability to apply MITRE ATT&CK to prioritize and validate detections while recognizing the limitations of framework-based coverage measures.
• Ability to coordinate delivery across teams and explain technical gaps, risk, and tradeoffs to technical and nontechnical stakeholders.
• Bachelor’s degree in a relevant field or equivalent practical experience.

Nice To Haves

• Experience delivering detection capabilities in a large, distributed enterprise with multiple markets or business units.
• Experience with cloud, identity, endpoint, network, and application telemetry.
• Experience building automated detection validation and integrating adversary emulation or purple-team exercises into engineering workflows.
• Experience managing dependencies and delivery expectations with external security service providers.
• Experience evaluating analytics and AI-assisted security capabilities through measurable operational outcomes.

Responsibilities

• Manage and develop detection engineers through hiring, coaching, performance management, and career development.
• Own the detection engineering roadmap, prioritized backlog, and delivery commitments; make tradeoffs explicit when risk, capacity, and technical dependencies compete.
• Establish responsibilities and working agreements with partner teams for telemetry onboarding, detection deployment, alert triage, and remediation.
• Communicate detection gaps, delivery risks, and resource needs to security leadership with actionable recommendations.
• Lead the design, development, testing, deployment, tuning, and retirement of detection content across relevant security platforms.
• Establish detection-as-code practices, including version control, peer review, automated testing, controlled deployment, and rollback.
• Ensure detections document behavior, required telemetry, validation evidence, known limitations, and investigation guidance.
• Maintain visibility into detection health, including failures caused by changes to data sources, schemas, configurations, or adversary behavior.
• Prioritize detection opportunities using relevant adversary techniques, threat intelligence, incident lessons, and the criticality of affected systems.
• Partner with technology owners to close telemetry gaps and improve the quality and availability of security data.
• Work with Offensive Security, Threat Intel, and Incident Response teams to validate detections through controlled testing and turn findings into engineering improvements.
• Translate threat-hunting findings into maintained detection content and identify opportunities for automation.
• Measure and report detection effectiveness through validated coverage, alert quality, telemetry health, and time to close priority gaps, distinguishing documented coverage from demonstrated detection capability.

Benefits

• Comprehensive health insurance, including medical, prescription drug, mental health, dental, and vision coverage.
• Life insurance.
• Bonus eligibility based on individual and company performance.
• Eligibility for stock or other equity grants under the long-term incentive plan.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior