Department Overview
McDonald's is seeking a Senior Manager, Detection Engineering to lead the team responsible for developing, validating, and maintaining threat detections across our global technology environment.
You will own the detection engineering roadmap and day-to-day delivery, translating threat intelligence, incident findings, offensive security results, and business risk into prioritized engineering work. You will develop the team, establish engineering standards, and ensure detections remain effective as our technology and threat landscape evolve.
This role requires a technically credible people leader. You should be comfortable reviewing detection logic, investigating telemetry gaps, challenging technical assumptions, and contributing directly to complex engineering problems while enabling the team to deliver independently.
You will work closely with Security Operations, Incident Response, Cyber Threat Intelligence, Offensive Security, and platform owners to improve our ability to identify and investigate threats across corporate and market environments.
Responsibilities
Lead the team and delivery
• Manage and develop detection engineers through hiring, coaching, performance management, and career development.
• Own the detection engineering roadmap, prioritized backlog, and delivery commitments. Make tradeoffs explicit when risk, capacity, and technical dependencies compete.
• Establish clear responsibilities and working agreements with partner teams for telemetry onboarding, detection deployment, alert triage, and remediation. • Communicate detection gaps, delivery risks, and resource needs to security leadership with actionable recommendations.
Own the detection lifecycle
• Lead the design, development, testing, deployment, tuning, and retirement of detection content across relevant security platforms.
• Establish detection-as-code practices, including version control, peer review, automated testing, controlled deployment, and rollback.
• Ensure detections include documented behavior, required telemetry, validation evidence, known limitations, and investigation guidance.
• Maintain visibility into detection health, including failures caused by changes to data sources, schemas, configurations, or adversary behavior.
Improve coverage and validate effectiveness
• Prioritize detection opportunities using relevant adversary techniques, threat intelligence, incident lessons, and the criticality of affected systems.
• Partner with technology owners to close telemetry gaps and improve the quality and availability of security data.
• Work with Offensive Security, Threat Intel, and Incident Response teams to validate detections through controlled testing and turn findings into engineering improvements.
• Translate threat-hunting findings into maintained detection content and identify opportunities for automation.
• Measure and report detection effectiveness through validated coverage, alert quality, telemetry health, and time to close priority gaps. Distinguish documented coverage from demonstrated detection capability.
Qualifications
Minimum qualifications
• Demonstrated experience developing and operating production detections, with depth in detection engineering and relevant experience in threat hunting, incident response, or security operations.
• Experience directly managing technical security staff, including coaching, performance management, and delivery accountability.
• Strong technical judgment in detection logic, adversary behavior, and the telemetry needed to identify malicious activity.
• Hands-on experience with SIEM and endpoint security platforms, detection query languages, and scripting or programming for security automation.
• Experience applying software engineering practices to security content, including version control, testing, and peer review.
• Ability to apply MITRE ATT&CK to prioritize and validate detections while recognizing the limitations of framework-based coverage measures.
• Ability to coordinate delivery across teams and explain technical gaps, risk, and tradeoffs to both technical and nontechnical stakeholders.
• Bachelor's degree in a relevant field or equivalent practical experience.
Preferred qualifications
• Experience delivering detection capabilities in a large, distributed enterprise with multiple markets or business units.
• Experience with cloud, identity, endpoint, network, and application telemetry.
• Experience building automated detection validation and integrating adversary emulation or purple-team exercises into engineering workflows.
• Experience managing dependencies and delivery expectations with external security service providers.
• Experience evaluating analytics and AI-assisted security capabilities through measurable operational outcomes.
Compensation
Bonus Eligible: YES
Long - Term Incentive: YES
Benefits Eligible: YES
Salary Range
The expected salary range for this role is $167,366.00 - $209,207.00 per year
The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we may also consider your experience, and other job-related factors.
Additional Information:
Benefits eligible: This position offers health and welfare benefits, including but not limited to comprehensive health insurance, which includes medical, prescription drug, mental health, dental and vision coverage, as well as, life insurance.
Bonus eligible: This position is eligible for a bonus, calculated based on individual and company performance.
Long term Incentive eligible: This position is eligible for stock or other equity grants pursuant to McDonald's long-term incentive plan.
