Security & Cyber Incident Response Engineer

Yum! Brands is seeking an Information Security & Cyber Incident Response Engineer to advance its global cybersecurity incident response program. The role investigates and resolves complex cybersecurity incidents, coordinates containment and recovery activities, leads high-severity incident response, and drives improvements to security processes, tooling, and controls.

Responsibilities:

• Lead technical investigation activities across endpoints, servers, networks, cloud environments, identities, applications, and other enterprise platforms to identify affected assets, accounts, data, indicators of compromise, attack vectors, and root cause
• Coordinate and execute technical containment, eradication, and remediation activities, including endpoint isolation, account disablement, access revocation, IOC blocking, credential resets, malware removal, vulnerability remediation, system reconfiguration, and other corrective actions as appropriate
• Maintain a comprehensive incident timeline and document investigative findings, technical decisions, response actions, approvals, communications, and evidence references throughout the incident lifecycle
• Partner with Security Operations, Cyber Threat Intelligence, Digital Forensics, Security Engineering, Vulnerability Management, Threat Hunting, Architecture, infrastructure teams, and other technical stakeholders to coordinate investigation and response activities
• Serve as Incident Response Lead for complex and high-severity cybersecurity incidents, independently coordinating technical workstreams, establishing investigative priorities, driving technical decisions, managing dependencies, and escalating material risks and decisions to cybersecurity leadership
• Apply threat intelligence and adversary behavior analysis during active investigations to reconstruct attack paths, identify attacker objectives, assess potential additional compromise, and inform containment and remediation strategies
• Lead and participate in incident response exercises, tabletop simulations, and post-incident reviews; identify capability gaps and own or drive continuous improvements to incident response playbooks, procedures, investigation methodologies, automation, tooling, monitoring, and technical controls
• Independently develop and coordinate technical response strategies for complex incidents, including situations where established playbooks, procedures, or precedent may not fully address the circumstances, exercising judgment based on incident type, severity, business impact, operational risk, evidence-preservation requirements, and business continuity considerations
• Validate the effectiveness of containment and remediation actions, confirm that residual indicators of compromise or attacker persistence have been removed, and ensure corrective actions address identified root causes and reduce the likelihood of recurrence
• Coordinate secure recovery of affected systems and services with infrastructure, application, cloud, and business teams, including validation of rebuilt systems, restored data, security configurations, and enhanced controls before returning systems to normal operation
• Coordinate technical response activities with third-party vendors, service providers, cloud providers, and external incident response partners in accordance with established incident response procedures and contractual requirements
• Maintain accurate, timely, and auditable Security Incident Records (SIRs) within ServiceNow, including incident scope, severity, investigation findings, actions taken, decisions, status updates, evidence references, and closure documentation
• Communicate technical findings, risks, incident impact, response options, dependencies, and implications of technical decisions to cybersecurity leadership, business stakeholders, executive leadership, and other technical and non-technical audiences as appropriate
• Identify systemic security control, monitoring, architecture, and operational gaps discovered through investigations and influence partner teams to implement corrective actions that reduce enterprise cybersecurity risk and the likelihood of recurrence
• Serve as a technical resource and mentor for less-experienced security engineers and analysts, providing guidance on investigation methodology, technical analysis, incident response decisions, and complex escalations

Requirements:

• • Bachelor's degree in computer science, information security or related field
• • Industry certifications such as CompTIA Security+, CompTIA CySA+, GIAC Certified Incident Handler (GCIH)
• • 5+ years of cybersecurity experience, including significant hands-on experience in security incident response, security operations, or equivalent relevant experience
• • Knowledge of incident response processes (detection, triage, incident research, remediation, and reporting)
• • Knowledge of administration and use of Linux, Mac, and Windows systems
• • Knowledge of complex cloud environments, specifically providers such as Azure and Amazon AWS
• • Ability to communicate complex technical findings, risks, and recommendations effectively to technical and non-technical audiences
• • Proficient in written and spoken English
• • Experience with leading Incident Response in a global organization with Cloud and Software as a Service exposure
• • Experience with large scale and complex incidents of all types to include Advanced Threats, DDoS, insider, web and mobile applications, data ex-filtration etc
• • Knowledge of Cybersecurity practices, operations, risk management processes, methods, architectural requirements, engineering and threats and vulnerabilities, including incident response methodologies
• • Thorough knowledge of networking and security architecture
• • Experience with ServiceNow Ticket Management and managing the SIR module