Job Description:
Company Description:
McDonald's is proud to be one of the most recognized brands in the world, with restaurants in over 100 countries that serve 70 million customers daily. As the global leader in the foodservice industry, our legacy of innovation and hard work continues to drive us.
From drive-thru updates to delivery to mobile order and pay, we are innovating quickly and growing. Joining McDonald's means thinking big and preparing for a career that can have influence around the world.
At McDonald's, we see every day as a chance to create a positive impact. We lead through our values centered on inclusivity, service, integrity, community, and family. From the support of Ronald McDonald House Charities to our Youth Opportunity project and sustainability initiatives, our values keep us dedicated to using our scale for good: good for our customers, people, industry, and the planet. We also offer outstanding benefits including a sabbatical program, tuition assistance, and flexible work arrangements.
We are an equal opportunity employer committed to the diversity of our crew members, staff, operators, and suppliers. We promote an inclusive work environment that creates feel-good moments for everyone. We are interested in people who enhance our company culture: Does this role interest you? We encourage you to apply even if you don't meet every single requirement!
Department Overview
The Analyst, Cyber Defense - Penetration Testing, is a technical role focused on proactive identification of vulnerabilities through offensive security testing. The ideal candidate should be familiar with adversary emulation in offensive security methodologies to help lead the battle-hardening of McDonald's information assets worldwide. This role will require the ability to assist in execution of application, cloud, and network penetration testing assessments. This role will assist with vulnerability validation and escalation from a variety of sources, including External Attack Surface Management (EASM) platform and Vulnerability Disclosure Programs (VDP). This role also regularly collaborates with technical and business stakeholders across the globe to ensure our senior leadership makes informed, risk-based decisions.
Duties
Assist and execute on network, application, cloud, and mobile application assessments.
Identify vulnerabilities and exposure within enterprise networks, systems, and applications by leading offensive security engagements.
Perform technical (evaluation of technology) and non-technical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas.
Create technical documents, reports, findings from the analysis, summaries, and other situational awareness information to relevant stakeholders.
Partner with other teams within McDonald's to improve threat response and attack surface across people, processes, and technology.
Analyze industry threat trends and regularly remain updated with ongoing adversarial activity to identify tactics, techniques, and procedures for emulation.
Validate vulnerabilities from a variety of sources, such as EASM, VDP, etc.
Read and understand basic scripts for proof-of-concepts and automations.
Perform basic code review for supporting application assessments.
Regularly update management and stakeholders on the progress of projects, ensuring timely and effective communication.
Ability to train others and act as a technical lead to help upskill the team.
Qualifications
Bachelor's degree or equivalent technical experience in offensive/defensive cybersecurity roles.
2-3 years of experience in technical offensive cybersecurity roles (e.g., ethical hacking, penetration testing, etc.).
Understanding the purpose and utilization of frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
Excellent written and verbal communication and presentation skills to effectively describe assessment details and technical analysis.
Ability to manage multiple concurrent workstreams and competing priorities.
Work within a global/multinational enterprise with flexible schedule accommodations for meetings, engagements, and operations.
Competency with technical writing and demonstrating various creative communication mechanisms to diverse audiences.
Ability to effectively draft and escalate remediation items for partner teams.
Basic knowledge of networking and web protocols (e.g., TCP/UDP, SSL/TLS, Wi-Fi protocols, routing, HTTP/S, REST/SOAP APIs, etc.).
Basic understanding of Windows, Active Directory, and Linux systems administration and attack surface.
Ability to read and write basic scripts (Python, PowerShell, Go, C, C++, C#, JavaScript, etc.).
Desired Skills
Master's degree or equivalent technical experience in offensive/defensive cybersecurity roles.
Professional credentials such as PJPT, OSCP, OWSP, PNPT, or comparable.
Experience delivering penetration testing activities, red teaming, mobile, and web application assessments to various customers concurrently.
Basic familiarity with working with and leveraging commercial and open-source offensive security tooling, such as C2 and Breach and Attack Simulations (BAS).
Fluency with External Attack Surface Management (EASM), Vulnerability Disclosure Programs (VDP), and other related services.
Exposure to using enterprise defensive security services such as EDR, SIEM, Email Gateway, and SOAR.
Compensation
Bonus Eligible: Yes
Long - Term Incentive: No
Benefits Eligible: Yes
Salary Range
The expected salary range for this role is $104,482.00 - $130,602.00 per year
The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we may also consider your experience, and other job-related factors.
Additional Information:
Benefits eligible: The position offers health and welfare benefits, including but not limited to comprehensive health insurance, which includes medical, prescription drug, mental health, dental and vision coverage, as well as, life insurance. This position offers health and welfare benefits, a 401(k) plan, adoption assistance program, educational assistance program, flexible ways of working, and time off policies (including sick leave, parental leave, and vacation/PTO). Eligibility requirements apply to some benefits and may depend on job classification and length of employment.
McDonald's is an equal opportunity employer committed to the diversity of our workforce. We promote an inclusive work environment that creates feel-good moments for everyone. McDonald's provides reasonable accommodations to qualified individuals with disabilities as part of the application or hiring process or to perform the essential functions of their job. If you need assistance accessing or reading this job posting or otherwise feel you need an accommodation during the application or hiring process, please contact mcdhrbenefits@us.mcd.com. Reasonable accommodations will be determined on a case-by-case basis.
McDonald's provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any @type without regard to sex, sex stereotyping, pregnancy (including pregnancy, childbirth, and medical conditions related to pregnancy, childbirth, or breastfeeding), race, color, religion, ancestry or national origin, age, disability status, medical condition, marital status, sexual orientation, gender, gender identity, gender expression, transgender status, protected military or veteran status, citizenship status, genetic information, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.
Nothing in this job posting or description should be construed as an offer or guarantee of employment.
Requsition ID: 3376
