Sr Analyst, Cyber Defense

Job Description:

Company

Description:

McDonald’s is proud to be one of the most recognized brands in the world, with restaurants in over 100 countries that serve 70 million customers daily. As the global leader in the food service industry, our legacy of innovation and hard work continues to drive us.

From drive-thru updates to delivery to mobile order and pay, we are innovating quickly and growing. Joining McDonald's means thinking big and preparing for a career that can have influence around the world.

At McDonald’s, we see every day as a chance to create a positive impact. We lead through our values centered on inclusivity, service, integrity, community, and family. From the support of Ronald McDonald House Charities to our Youth Opportunity project and sustainability initiatives, our values keep us dedicated to using our scale for good: good for our customers, people, industry, and the planet.

We also offer outstanding benefits including a sabbatical program, tuition assistance, and flexible work arrangements.

We are an equal opportunity employer committed to the diversity of our crew members, staff, operators, and suppliers. We promote an inclusive work environment that creates feel-goods moments for everyone. We are interested in people who enhance our company culture:
Does this role interest you? We encourage you to apply even if you don’t meet every single requirement!

As an L3 Response Analyst in the Security Operations Center (SOC), you apply defensive techniques and information from multiple sources to detect, analyze, and report cybersecurity incidents. You help protect McDonald's information assets. You support Incident Response, handle crisis situations, and reduce both immediate and potential cyber threats. Your knowledge of security operations, event monitoring, eDiscovery, forensics, and incident response is essential.

This role is part of Global Cyber Security (GCS), which manages our Cybersecurity Defense & Incident Response program and critical services. It ensures leadership receives informed, risk-based insights.

Working within the Incident Response team and coordinating with other Cyber Defense teams to identify and report on security incidents as they occur and overseeing end-to-end remediation. Activities will include triaging security events, network and endpoint analysis, malware reverse engineering, threat hunting, vulnerability-related blocking issues, and resolving security incidents from detection to remediation. As part of the Security Defense team, you will create and implement standard operating procedures, playbooks, and processes to help streamline response monitoring, investigations, and analysis research.

The role works directly within GCS, the organization responsible for our Cybersecurity Defense & Incident Response program and critical services, ensuring our leadership makes informed risk-based decisions.

The ideal candidate must have strong knowledge of cybersecurity practices, cloud platforms, detection and response systems, and all incident‑handling phases (containment, eradication, recovery, and lessons learned). They must follow and promote established incident response playbooks and procedures, work accurately, and collaborate effectively with global cross‑functional teams.

Required competencies:

• Advanced understanding of computer networking concepts, protocols, and network security methods.
• Solid experience assessing and reducing cyber threats and vulnerabilities.
• Advanced skills in authentication, authorization, and access control.
• Ability to apply and develop intrusion detection methods for host- and network-based threats.
• Strong knowledge of system and application security risks and the ability to develop and implement mitigation measures.
• Broad awareness of network attacks, related threats and vulnerabilities, and the ability to define countermeasures.
• Expertise in adversarial tactics, techniques, and procedures, with the ability to anticipate and neutralize them.
• Proficiency in eDiscovery and forensic investigations, including evidence collection, preservation, analysis, and presentation.
• Deep understanding of cyber‑attack phases…