Manager Of Cybersecurity Governance & Compliance

McDonald’s new growth strategy, Accelerating the Arches, encompasses all aspects of our business as the leading global omni-channel restaurant brand. As the consumer landscape shifts we are using our competitive advantages to further strengthen our brand. One of our core growth strategies is to Double Down on the 3Ds (Delivery, Digital and Drive Thru). McDonald’s will accelerate technology innovation so 65M+ customers a day will experience a fast, easy experience, whether at one of our 25,000 and growing Drive Thrus, through McDelivery, dine-in or takeaway.

Leading this tech revolution is McDonald’s Global Technology organization made up of intrapreneurs who get to build really cool tech with scary smart people using the latest innovations like AI, IOT, and edge computing. We do this working along diverse, global teams who are always hungry for a challenge. It’s bonus points when you get to see your family and friends use the tech you build at their favorite McD restaurant.

This role will collaborate closely with cybersecurity experts, market leads, project managers, and Global Technology Solutions teams to ensure the reliable and efficient operation of McDonald’s security services. In addition, this role will be responsible for managing and collaborating with the support teams that handle tickets and other operational tasks for McDonald’s security services. This person will work closely with others in Global Technology Risk Management and other areas of Global Technology to ensure that our services are meeting the needs of markets, application teams, and other stakeholders.

Check out the Global Technology Technical Blog to learn how technology is directly enabling the Accelerating the Arches strategy.

The role will be focused initially on Sarbanes-Oxley compliance across five countries, helping management to enhance the effectiveness and efficiency of existing IT controls. Additionally, the Manager will help design and implement controls that will be operated by IT Compliance, as well as help automate compliance activities wherever possible. The manager will demonstrate strong risk and control experience to assist clients, gain alignment with auditors, and guide analysts in optimizing risk management for the Global Technology organization.

This person will develop our IT Compliance services including the maintenance and development of controls and control automation. The ideal candidate will demonstrate experience in both conducting assessments and building technical solutions, compliance, privacy, and information security. We’re seeking a hands-on leader with both project management and technical experience, who is willing and able to lead by example for compliance activities and improving processes. The manager should have a shown ability to lead, develop, and guide others, building a strong team that delivers high-impact results.

Accountabilities & Responsibilities:

• Lead the Sarbanes-Oxley compliance portion of our Cybersecurity Governance & Compliance team, ensuring that compliance activities are successfully completed on-time and on-budget.
• Lead regular compliance-related activities, such as finalizing compliance scope, updating policy content, delivering training, and running issue remediation.
• Design and complete second line of defense controls, while working with management to reduce the need for additional control layers.
• Drive automation and off-shoring of control activities, increasing the efficiency, effectiveness, and scalability of the control environment.
• Anticipate and identify control issues and risk challenges, assisting with the long-term IT control strategy beyond Sarbanes-Oxley.
• Partner with all parties for Sarbanes-Oxley compliance, setting scope and objectives, enhancing the risk and control set, influencing the testing approach, handling key communications, supporting audits, and leading issue remediation efforts.
• Partner with the Internal Audit and External Audit teams, ensuring that current and future audit requirements are met and gaining alignment on our go-forward strategy, while successfully addressing compliance challenges.
• Actively participate in the department’s strategy, processes, and approaches, demonstrating strong security, privacy, and compliance domain knowledge.
• Work effectively with leadership on compliance and risk topics, helping align our efforts with leaders and gain their support to address issues and improve the control environment.
• Earn trust with leadership by efficiently running sensitive risk and audit discussions, communications, and work.
• Provide relevant hands-on guidance to team members during work activities, providing real-time mentoring and coaching through clear guidance, instruction, and support.
• Ability to live the McDonald’s values every day: Serve, Inclusion, Integrity, Community, and Family.
• Bachelor's degree in Engineering, Computer Science, Information Technology, or related field
• 6+ years of related work experience
• Experience in delivering and leading risk and compliance activities and projects, potentially including technical evaluation, information technology audits, financial compliance (Sarbanes-Oxley) audits, and advisory projects
• Experience developing teams, delivering high-quality audit work products, and communicating effectively with various partners (e.g., technology teams, audit, senior management)
• Familiarity with information technology, business processes, and familiarity with control frameworks such as NIST, COBIT, ITIL, PCI, ISO, SOX, and global data privacy laws (e.g. GDPR, CCPA, CPRA)
• Proven to lead through influence and build relationships through collaboration

• Experience with programming, scripting, and technical solution design and development
• Master’s degree and additional degrees preferred
• Strong knowledge across IT processes such as security operations, program management, security administration, system operations, change management, modern development (e.g., DevOps, Agile), data governance, privacy, and incident/problem management.
• Professional credentials preferred (OSCP, CRTO, CISSP, CEH, CIPT, CDPSE, CISA, or comparable).

McDonald’s is committed to providing qualified individuals with reasonable accommodations to perform the essential functions of their jobs. Additionally, if you (or another applicant of whom you are aware) require assistance accessing or reading this job posting or otherwise seek assistance in the application process, please contact recruiting.supportteam@us.mcd.com

McDonald’s provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to sex, sex stereotyping, pregnancy (including pregnancy, childbirth, and medical conditions related to pregnancy, childbirth, or breastfeeding), race, color, religion, ancestry or national origin, age, disability status, medical condition, marital status, sexual orientation, gender, gender identity, gender expression, transgender status, protected military or veteran status, citizenship status, genetic information, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Nothing in this job posting or description should be construed as an offer or guarantee of employment.