Penetration Testing Lead Analyst

McDonald's Corporation; Chicago (IL); On-site; USD 167,000 - 209,000; Full time

Benefits offered by this job

Bonus Eligible

Long Term Incentive

Benefits Eligible

Job summary

McDonald’s Corporation is seeking a Lead Analyst, Cyber Defense – Penetration Testing to drive proactive vulnerability discovery across global assets. The role requires advanced offensive security expertise to lead application, cloud, and network assessments and emulate threat actors across enterprise environments.

The ideal candidate will coordinate with stakeholders worldwide, create technical reports, and develop scripts for concepts and automation while mentoring the team and guiding purple

Qualifications

• Bachelor's degree or equivalent technical experience in offensive/defensive cybersecurity roles.
• 5-8 years of experience in technical offensive cybersecurity roles (e.g. ethical hacking, penetration testing, etc.).
• Understanding the purpose and utilization of frameworks, such as MITRE ATT&CK and the Cyber Kill Chain.
• Excellent written and verbal communication/presentation skills to effectively describe assessment details and technical analysis.

Responsibilities

• Plan and lead red team adversary emulation exercises across the enterprise.
• Lead application, network, cloud, and mobile application assessments.
• Identify vulnerabilities and exposure within enterprise networks, systems, and applications by leading offensive security engagements.
• Produce scripts for proof-of-concepts and automations.
• Regularly update management and stakeholders on project progress.

Skills

Penetration testing

Offensive security

Cloud security

Networking

Python/PowerShell

Education

Bachelor's degree or equivalent in cybersecurity

Tools

MITRE ATTACK

Cyber Kill Chain

C2

BAS

EASM

Job description

Job Description:

Company Description:

McDonald’s growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omni-channel restaurant brand. As the consumer landscape shifts we are using our competitive advantages to further strengthen our brand. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive thrus, through McDelivery, dine-in or takeaway.

McDonald’s Global Technology is here to power tomorrow’s feel-good moments.

That’s why you’ll find us at the forefront of transformative technology, exploring new and innovative ways to serve our millions of customers and spread happiness one delicious Hot Fudge Sundae-dipped fry at a time.Using AI, robotics and emerging tech, we’re digitizing the Golden Arches. Combine that with our unparalleled global scale, and we’re reshaping all areas of the business, industry and every community that is home to a McDonald’s restaurant.We face complex tech challenges every day. But that’s where our diverse and talented teams come in. They’re made up of the best and brightest from all over the globe, and they thrive in the space where feel-good meets fast-paced.

Check out the McDonald’s Global Technology Technical Blog to learn how technology and our global team are directly enabling the Accelerating the Arches strategy.

Department Overview

The Lead Analyst, Cyber Defense – Penetration Testing, is a technical role focused on proactive identification of vulnerabilities through offensive security testing. The ideal candidate should be a seasoned, trusted adversary with advanced expertise in offensive security methodologies to help lead the battle-hardening of McDonald's information assets worldwide. This role will require the ability to lead and execute application, cloud, and network penetration testing assessments. This role also regularly collaborates with technical and business stakeholders across the globe to ensure our senior leadership makes informed, risk-based decisions. This analyst should also be able to emulate advanced threat actors in both overt and no-knock red team assessments.

Responsibilities

• Ability to plan and lead red team adversary emulation exercises across the enterprise.
• Lead application, network, cloud, and mobile application assessments.
• Identify vulnerabilities and exposure within enterprise networks, systems, and applications by leading offensive security engagements.
• Perform technical (evaluation of technology) and non-technical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas.
• Create technical documents, reports, findings from the analysis, summaries, and other situational awareness information to relevant stakeholders.
• Partner with other teams within McDonald’s to improve threat response and attack surface across people, processes, and technology.
• Analyze industry threat trends and regularly remain updated with ongoing adversarial activity to identify tactics, techniques, and procedures for emulation.
• Exploit embedded systems, web and mobile apps, cloud platforms, and office and restaurant digital networks.
• Produce scripts for proof-of-concepts and automations.
• Perform code review for supporting application assessments.
• Regularly update management and stakeholders on the progress of projects, ensuring timely and effective communication.
• Ability to train others and act as a technical lead to help upskill the team.
• Experience managing purple team simulations with partners in defensive functions.

Qualifications

• Bachelor's degree or equivalent technical experience in offensive/defensive cybersecurity roles.
• 5-8 years of experience in technical offensive cybersecurity roles (e.g. ethical hacking, penetration testing, etc.)
• Understanding the purpose and utilization of frameworks, such as MITRE ATT&CK and the Cyber Kill Chain.
• Excellent written and verbal communication/presentation skills to effectively describe assessment details and technical analysis.
• Advanced ability to manage multiple concurrent workstreams and competing priorities. Work within a global/multinational enterprise with flexible schedule accommodations for meetings, engagements, and operations.
• Extended experience with technical writing and demonstrating various creative communication mechanisms to diverse audiences.
• Advanced knowledge of networking and web protocols (e.g., TCP/UDP, SSL/TLS, Wi-Fi protocols, routing, HTTP/S, REST/SOAP APIs, etc.).
• Advanced knowledge of Windows/Active Directory/Linux systems administration and attack surface.
• Proficiency with programming and scripting (Python, PowerShell, Go, C, C++, C#, JavaScript, etc.).

Desired Skills

• Master’s degree or equivalent technical experience in offensive/defensive cybersecurity roles.
• 2-3 years of additional experience in related technical cybersecurity roles (e.g. incident response, security operations, detection engineering, etc.).
• Professional credentials, such as OSCP, OSCE, OSEP, OSWE, GWAPT, GPEN, GXPN, GRTP, CRTO, PNPT, or comparable.
• Experience delivering and leading penetration testing activities, red teaming, mobile, and web application assessments, etc., to various customers concurrently.
• Competency in working with and leveraging commercial/open-source offensive security tooling, such as C2, Breach and Attack Simulations (BAS), External Attack Surface Management (EASM), and other related services.
• Exposure to managing/using enterprise defensive security services such as EDR, SIEM, Email Gateway, and SOAR.

Compensation

Bonus Eligible: YES

Long - Term Incentive: YES

Benefits Eligible: YES

Salary Range

The expected salary range for this role is$167,366.00 -$209,207.00per year

The above represents the expectedsalaryrange for this job requisition. Ultimately, in determining yourpay, we may also consider your experience, and other job-related factors.

Additional Information

Benefits eligible: This position offers health and welfare benefits, including but not limited to comprehensive health insurance, which includes medical, prescription drug, mental health, dental and vision coverage, as well as, life insurance.

Bonus eligible: This position is eligible for a bonus, calculated based on individual and company performance.

Long term Incentive eligible: This position is eligible for stock or other equity grants pursuant to McDonald’s long-term incentive plan.

McDonald’s is an equal opportunity employer committed to the diversity of our workforce. We promote an inclusive work environment that creates feel-good moments for everyone. McDonald’s provides reasonable accommodations to qualified individuals with disabilities as part of the application or hiring process or to perform the essential functions of their job. If you need assistance accessing or reading this job posting or otherwise feel you need an accommodation during the application or hiring process, please contact [e-mail]. Reasonable accommodations will be determined on a case-by-case basis.

McDonald’s provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to sex, sex stereotyping, pregnancy (including pregnancy, childbirth, and medical conditions related to pregnancy, childbirth, or breastfeeding), race, color, religion, ancestry or national origin, age, disability status, medical condition, marital status, sexual orientation, gender, gender identity, gender expression, transgender status, protected military or veteran status, citizenship status, genetic information, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Nothing in this job posting or description should be construed as an offer or guarantee of employment.