This role pays more than
86%
of similar roles. Most pay
$161,250–$240,687
— the shaded band above.
At the midpoint, this role pays about
$267k
versus about
$201k
for comparable roles.
Based on 240 similar postings.
Employer
About McDonald’s Corporation
McDonald’s Corporation is the world's largest fast-food chain by revenue, operating over 40,000 locations in more than 100 countries.
McDonald’s Corporation currently has
49 open roles
on FindRole.
Listed pay typically runs
$138,207–$172,758
across 24 roles with salary data.
Sr Director, Cyber Third-Party Risk Management leads and modernizes the global third-party cyber risk management capability across a distributed, market-driven technology and supplier ecosystem. This leader is responsible for designing and executing a scalable, intelligence-driven program that moves beyond traditional questionnaire-centric models to incorporate technical validation, automation, and continuous monitoring. The role involves managing the full lifecycle of third-party risk, including onboarding, tiering, due diligence, and offboarding while addressing complex integrations in IDL market segments. Key responsibilities include building a high-performing team, providing executive reporting on risk posture, and collaborating with procurement, legal, and privacy teams to standardize enterprise agreements. The ideal candidate possesses technical fluency in cloud, APIs, identity, and data flows, alongside expertise in NIST CSF, ISO 27001, GDPR, and CCPA to mitigate systemic and concentration risks within the supply chain.
Lead and modernize the global third-party cyber risk management program across a distributed technology ecosystem.
Transition the TPRM process from questionnaire-based assessments to technical validation, automation, and continuous monitoring.
Manage the full third-party risk lifecycle including onboarding, tiering, due diligence, and secure offboarding.
Implement automated tools and AI-assisted techniques for evidence collection and risk scoring.
Maintain a centralized inventory of third-party engagements and report risk trends to senior leadership.
Partner with internal stakeholders to standardize security configurations and contract requirements across different markets.
Build and lead a high-performing team of third-party risk professionals and technical reviewers.
What we're looking for
12+ years of experience in cybersecurity, technology risk, or information security with significant ownership of third-party cyber risk management in large enterprises.
Proven experience designing and leading a global TPRM program including the full lifecycle from onboarding to offboarding.
Demonstrated success modernizing TPRM by moving beyond questionnaire-centric models toward technical validation, automation, and continuous monitoring.
Strong technical fluency across cloud, APIs, identity, data flows, and integration architectures.
Experience overseeing deep technical assessments for high-risk third parties including architecture reviews and penetration testing results.
Ability to operate in distributed environments while translating local solutions into standardized enterprise security requirements.
Demonstrated leadership experience building high-performing teams and influencing senior stakeholders across multiple business functions.
Strong executive communication skills for reporting third-party cyber risk posture and trends to senior leadership.
Familiarity with systemic, concentration, and fourth-party risk (preferred).
Working knowledge of NIST CSF, ISO 27001, GDPR, and CCPA (preferred).
Relevant certifications such as CISSP, CISM, CRISC, or CISA (preferred).