Sr Manager, Cyber Defense

McDonald's; Greater London; Vor Ort; GBP 90.000 - 120.000; Vollzeit

Zusammenfassung

McDonalds in the United Kingdom seeks a Senior SOC Leader to direct the UK-based Security Operations Center, overseeing monitoring, triage, investigation and escalation for the EMEA region.

You will mentor analysts, manage shift patterns, and drive security metrics while coordinating with global teams to sustain incident response readiness and a proactive security program.

Qualifikationen

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.
• 6+ years of experience in cybersecurity operations, security monitoring, detection and response, or IT security incident management.
• Demonstrated experience leading or supervising SOC teams, including direct people management, coaching, and performance management.
• Deep technical understanding of SIEM platforms, SOAR orchestration, EDR/XDR solutions, log management, and security event investigation workflows.
• Expert-level understanding of security monitoring, alert triage methodologies, incident escalation frameworks, and the cyber kill chain.
• In-depth understanding and practical application of the NIST Cybersecurity Framework.
• Strong experience working with a SOC/NOC and coordinating with legal and market operations during incidents.
• Strong communication and stakeholder management skills, with the ability to translate operational data and security events into business risk language.
• Proven ability to operate under pressure, manage competing priorities, and lead teams through high-stress incident response situations.
• Willingness and ability to work non-standard hours, including nights, weekends, and holidays, in support of active incident response and global SOC coverage requirements.
• Professional certifications such as CISSP, CISM, GCIH, GCIA, GCFA, GREM, OSCP, or equivalent.
• Experience with Google SecOps/Azure Sentinel, Defender/SentinelOne/CrowdStrike, or comparable SIEM/EDR platforms at enterprise scale.
• Outstanding technical writing skills and the ability to communicate to diverse audiences.

Aufgaben

• Lead the UK-based SOC team delivering monitoring, triage, investigation, and escalation across the EMEA timezone within the follow-the-sun GSOC model, owning the UK shift and ensuring clean handovers with the US and India locations.
• Manage the end-to-end lifecycle of EMEA security events — from detection through investigation and escalation to Incident Response (CIRT) to closure — in line with defined SLOs and KPIs, coordinating with market security and technology teams.
• Identify and investigate intrusions and drive effective response using SIEM, SOAR, EDR/XDR, and email security solutions, supporting threat hunting and developing remediation plans across EMEA markets.
• Provide detection tuning and feedback loops to Detection Engineering and managed providers, and coordinate with CIRT and Cyber Threat Intelligence on handoffs and IOC enrichment.
• Lead, mentor, and develop the UK team of analysts — managing shift scheduling, capacity, and performance while providing hands-on technical guidance to mature their tradecraft and response capabilities.
• Be accountable for UK SOC metrics (MTTD, MTTR, MTTC, case backlog) and translate operational data into executive-ready narratives, driving continuous improvement of the SOC.

Kenntnisse

SOC leadership

Incident response

SIEM/SOAR/EDR expertise

Threat detection & hunting

NIST framework

Communication & stakeholder mgmt

Pressure handling

Ausbildung

Bachelor’s degree in Computer Science, Cybersecurity or equivalent

Tools

SIEM platforms

SOAR orchestration

EDR/XDR solutions

Google SecOps

Azure Sentinel

CrowdStrike

SentinelOne

Defender

Jobbeschreibung

Company Description

McDonald’s is proud to be one of the most recognized brands in the world, with restaurants in over 100 countries that serve 70 million customers daily. As the global leader in the food service industry, our legacy of innovation and hard work continues to drive us. From drive thru updates to delivery to mobile order and pay, we are innovating quickly and growing. Joining McDonald's means thinking big and preparing for a career that can have influence around the world.

Department Overview

• McDonald’s new growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omnichannel restaurant brand. As the consumer landscape shifts, we are using our competitive advantages to strengthen our brand further. One of our core growth strategiesis toDouble Down on the 3Ds (Delivery, Digital, and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive-Thrus, throughMcDelivery, dine-in, or takeaway.
• McDonald’s Global Technology organization is leading this tech revolution, comprised of intrapreneurs who get to build cool tech with scary intelligent people using the latest innovations like AI, IoT, and edge computing. We do this by working with diverse, global teams who are always hungry for a challenge. It’s bonus points when you see your family and friends use the tech you build at their favorite McD restaurant.
• As we have matured as an engineering organization and seen the demands for technology grow exponentially, we’re gearing up to deliver on the next set of opportunities for the business. We are building up an in-house engineering team accountable for our strategic products, working alongside diverse squads of internal engineers and partners to solve technology innovation challenges at an incredible scale.

Duties

• Security Operations & Service Delivery (UK / EMEA)
  • Lead the UK-based SOC team delivering monitoring, triage, investigation, and escalation across the EMEA timezone within the follow-the-sun GSOC model, owning the UK shift and ensuring clean handovers with the US and India locations.
  • Manage the end-to-end lifecycle of EMEA security events — from detection through investigation and escalation to Incident Response (CIRT) to closure — in line with defined SLOs and KPIs, coordinating with market security and technology teams.
• Detection & Response Operations
  • Identify and investigate intrusions and drive effective response using SIEM, SOAR, EDR/XDR, and email security solutions, supporting threat hunting and developing remediation plans across EMEA markets.
  • Provide detection tuning and feedback loops to Detection Engineering and managed providers, and coordinate with CIRT and Cyber Threat Intelligence on handoffs and IOC enrichment.
• People Leadership & Team Development
  • Lead, mentor, and develop the UK team of analysts — managing shift scheduling, capacity, and performance while providing hands-on technical guidance to mature their tradecraft and response capabilities.
• Metrics, Reporting & Program Maturity
  • Be accountable for UK SOC metrics (MTTD, MTTR, MTTC, case backlog) and translate operational data into executive-ready narratives, driving continuous improvement of the SOC.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.
• 6+ years of experience in cybersecurity operations, security monitoring, detection and response, or IT security incident management.
• Demonstrated experience leading or supervising SOC teams, including direct people management, coaching, and performance management.
• Deep technical understanding of SIEM platforms, SOAR orchestration, EDR/XDR solutions, log management, and security event investigation workflows.
• Expert-level understanding of security monitoring, alert triage methodologies, incident escalation frameworks, and the cyber kill chain.
• In-depth understanding and practical application of the NIST Cybersecurity Framework.
• Strong experience working with a SOC/NOC and coordinating with legal and market operations during incidents.
• Strong communication and stakeholder management skills, with the ability to translate operational data and security events into business risk language.
• Proven ability to operate under pressure, manage competing priorities, and lead teams through high-stress incident response situations.
• Willingness and ability to work non-standard hours, including nights, weekends, and holidays, in support of active incident response and global SOC coverage requirements.
• Professional certifications such as CISSP, CISM, GCIH, GCIA, GCFA, GREM, OSCP, or equivalent.
• Experience with Google SecOps/Azure Sentinel, Defender/SentinelOne/CrowdStrike, or comparable SIEM/EDR platforms at enterprise scale.
• Outstanding technical writing skills and the ability to communicate to diverse audiences.

Additional Information

At McDonalds we are People from all Walks of Life...

People are at the heart of everything we do, and they make the McDonalds experience. We embrace diversity and are committed to creating an inclusive culture that means people can be their best authentic self in our restaurants and offices, which helps us to better serve our customers. We have a strong heritage of diversity and representation within our communities, which we are proud of. The diversity of our people, customers, Franchisees, and suppliers gives us strength.

We do not tolerate inequality, injustice, or discrimination of any kind. These are hugely important issues and a brand with our reach and relevance means we have a very meaningful role to play.

We also recognise our responsibility as a large employer to continue being active in our communities, helping to develop skills and drive aspirations that will help people to be more aware of the world of work and more successful within it, whether with McDonalds or elsewhere.