Senior Analyst, Cyber Defence

at  McDonalds Corporation

Company Description
McDonald’s new growth strategy, Securing the Arches, encompasses all aspects of our business as the leading global omnichannel restaurant brand. As the consumer landscape shifts, we use our competitive advantages to strengthen our brand further. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital, and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive-Thrus, through McDelivery, dine-in, or takeaway.
McDonald’s Global Technology organization leads this tech revolution, comprised of intrapreneurs who get to build cool tech with scary intelligent people using the latest innovations like AI, IoT, and edge computing. We do this by working along diverse, global teams who are always hungry for a challenge. It is a bonus point when you see your family and friends use the tech you build at their favourite McD restaurant.
As we have matured as an engineering organization and seen the demands for technology grow exponentially, we are gearing up to deliver on the next set of opportunities for the business. We are building our internal team to support our growing needs in cybersecurity. We are building various squads of subject matter experts with traditional and specialized skill sets, both from internal departments and with our partners, to help us flex with demand and solve technology innovation challenges at an incredible scale.
Job Description
The Senior Analyst, Cyber Defence will support the cybersecurity response program by consistently delivering timely, actionable, and relevant threat intelligence to enable the improvement of McDonald’s security posture. The Senior Analyst, Cyber Defence is responsible for collecting, analysing, and disseminating cyber threat intelligence. These capabilities will include the timely collection of advanced warnings of impeding IT vulnerabilities or threats, a thorough correlation, analysis, and storage of threat intelligence information, and tactical support of the incident response process. They will also support the definition, delivery, and sustainment of the cybersecurity response strategy.

REQUIRED SKILLS

• Familiar with network security architecture concepts, including topology, protocols, components, and principles (e.g., application of defense-in-depth).
• Experience working with Information Sharing Organizations and Analysis Centers. Additionally, candidates with experience developing enterprise-level intelligence/information-sharing policies and standards are preferred.
• Experienced in cybersecurity principles and organizational requirements, including threat detection, incident response, and security operations methodologies.
• Experience in investigating threats, utilizing open source intelligence (OSINT), intelligence from trusted third parties, and other information sources to uncover threat actors and their tactics, techniques, and procedures (TTPs) while providing context to threats and reaching conclusions from incomplete or missing data.
• Capability to work effectively and efficiently with minimal oversight in a fast-paced and fluid operating environment.
• A robust team-player mentality and a willingness to work with a disparate global team.
• Strong familiarity working with Threat Intelligence Platforms such as Analyst1, i2 Analyst Notebook, Anomali Threatstream, etc.
• Strong Understanding of Intelligence and Security Solutions such as ProofPoint, Digital Shadows, Cyjax, and Q-Radar.
• Exceptional communication and presentation skills.
• Demonstrated capability to deliver well-written, timely, actionable, and relevant threat intelligence products at the tactical, operational, and strategic levels (must provide examples or complete a writing prompt).

QUALIFICATIONS

• Bachelor’s degree or equivalent OTJ experience.
• Military or Government All-Source Intelligence or Cyber Intelligence background
• GIAC Security Essentials, CompTIA Security+, EC-Council C|TIA, or equivalent training.
• Experience in a role that required daily interaction with Cyber Security personnel, tools, and processes.
• Experience working in a focused Intelligence role.
• Internal and external threat reconnaissance.

DESIRABLE QUALIFICATIONS:

• Capability to interpret and comprehend scripts and various programming languages. Highly desired skills in Python, R, or similar scripting languages (must provide examples).
• Fundamental understanding of Security Automation and Orchestration (SOAR).
• Strong understanding of data analytics and data visualization best practices.
• OKR Certified or Foundational understanding of methodologies behind driving Objectives and Key Results.
• Effectively prioritize in high-pressure situations
• Demonstrated track record of success in delivering in a security environment
• Ability to present publicly as a thought leader in security
• Strong analytical skills and cross-functional knowledge across multiple security disciplines
• Must possess a high degree of integrity, be trustworthy, and have the ability to work with autonomy
• Strong interpersonal communication, negotiation, and presentation skills
  Additional Information

• Support the Security Operations Centre (SOC) in effectively detecting, analysing, and containing cyber attacks. Provides direct operational and tactical support to security operations and incident response processes. Provide Tier III analytical support for escalated security incidents.
• Triage intelligence alerts/events from intelligence partners.
• Authoring cyber threat intelligence reports supporting the needs of internal and external stakeholders at the tactical, operational, and strategic levels.
• Maintain awareness of geopolitical issues and their influence on the global or relevant regional threat landscape.
• Detailed information correlation, analysis, and subject matter expertise of cyber threats as it applies to the Retail and Hospitality Sector.
• Daily review and triage of intelligence alerts and reporting.
• Indicator of Compromise (IOC) / Observable extraction, enrichment, and correlation.
• In the absence of direct leadership, oversee the threat intelligence program, including supporting personnel, developing requirements, policy enforcement, emergency planning, security awareness, and other resources.
• Aid in developing policies and plans and/or advocating for changes that support threat intelligence initiatives or required changes/enhancements.
• Maintain an understanding of attacks, vectors, and emerging threats.