Security and Cyber Incident Response Engineer

Yum! Brands is a global company seeking an Information Security & Cyber Incident Response Engineer to advance its global cybersecurity incident response program. The role investigates, contains, remediates, and coordinates recovery from complex cybersecurity incidents while partnering with technical teams, business stakeholders, vendors, and leadership; it also leads incident response exercises and mentors security personnel.

Responsibilities:

• Lead technical investigation activities across endpoints, servers, networks, cloud environments, identities, applications, and other enterprise platforms to identify affected assets, accounts, data, indicators of compromise, attack vectors, and root cause
• Coordinate and execute technical containment, eradication, and remediation activities, including endpoint isolation, account disablement, access revocation, IOC blocking, credential resets, malware removal, vulnerability remediation, system reconfiguration, and other corrective actions as appropriate
• Maintain a comprehensive incident timeline and document investigative findings, technical decisions, response actions, approvals, communications, and evidence references throughout the incident lifecycle
• Partner with Security Operations, Cyber Threat Intelligence, Digital Forensics, Security Engineering, Vulnerability Management, Threat Hunting, Architecture, infrastructure teams, and other technical stakeholders to coordinate investigation and response activities
• Serve as Incident Response Lead for complex and high-severity cybersecurity incidents, independently coordinating technical workstreams, establishing investigative priorities, driving technical decisions, managing dependencies, and escalating material risks and decisions to cybersecurity leadership
• Apply threat intelligence and adversary behavior analysis during active investigations to reconstruct attack paths, identify attacker objectives, assess potential additional compromise, and inform containment and remediation strategies
• Lead and participate in incident response exercises, tabletop simulations, and post-incident reviews; identify capability gaps and own or drive continuous improvements to incident response playbooks, procedures, investigation methodologies, automation, tooling, monitoring, and technical controls
• Independently develop and coordinate technical response strategies for complex incidents, including situations where established playbooks, procedures, or precedent may not fully address the circumstances, exercising judgment based on incident type, severity, business impact, operational risk, evidence-preservation requirements, and business continuity considerations
• Validate the effectiveness of containment and remediation actions, confirm that residual indicators of compromise or attacker persistence have been removed, and ensure corrective actions address identified root causes and reduce the likelihood of recurrence
• Coordinate secure recovery of affected systems and services with infrastructure, application, cloud, and business teams, including validation of rebuilt systems, restored data, security configurations, and enhanced controls before returning systems to normal operation
• Coordinate technical response activities with third-party vendors, service providers, cloud providers, and external incident response partners in accordance with established incident response procedures and contractual requirements
• Maintain accurate, timely, and auditable Security Incident Records (SIRs) within ServiceNow, including incident scope, severity, investigation findings, actions taken, decisions, status updates, evidence references, and closure documentation
• Communicate technical findings, risks, incident impact, response options, dependencies, and implications of technical decisions to cybersecurity leadership, business stakeholders, executive leadership, and other technical and non-technical audiences as appropriate
• Identify systemic security control, monitoring, architecture, and operational gaps discovered through investigations and influence partner teams to implement corrective actions that reduce enterprise cybersecurity risk and the likelihood of recurrence
• Serve as a technical resource and mentor for less-experienced security engineers and analysts, providing guidance on investigation methodology, technical analysis, incident response decisions, and complex escalations
• Demonstrate consistent compliance with critical-incident engagement and on-call response requirements, including investigation initiation within required response timeframes
• Maintain at least 95% timely and complete Security Incident Record documentation for assigned incidents, including scope, decisions, evidence references, response actions, and closure details
• Complete or materially improve priority incident response playbooks, procedures, or investigation workflows based on identified operational gaps and lessons learned
• Drive corrective actions from significant incidents and post-incident reviews to completion within agreed timelines, with measurable reduction in repeat issues attributable to previously identified root causes
• Deliver measurable improvements to incident response capability through enhanced playbooks, automation, tooling, monitoring, or investigation methodologies
• Demonstrate sustained technical leadership on complex and high-severity incidents, including effective coordination, decision-making, escalation, and recovery
• Produce accurate, defensible investigations and validate containment, eradication, remediation, and secure recovery before incident closure
• Improve response consistency and reduce avoidable investigation or remediation delays through reusable processes, automation, and technical standards
• Mentor less-experienced team members, provide guidance on complex escalations, and influence partner teams to address systemic security gaps
• Communicate incident risk, impact, response options, dependencies, and technical decisions clearly to cybersecurity leadership, business stakeholders, and executive audiences

Requirements:

• Bachelor's degree in computer science, information security or related field
• Industry certifications such as CompTIA Security+, CompTIA CySA+, GIAC Certified Incident Handler (GCIH)
• 5+ years of cybersecurity experience, including significant hands-on experience in security incident response, security operations, or equivalent relevant experience
• Knowledge of incident response processes (detection, triage, incident research, remediation, and reporting)
• Knowledge of administration and use of Linux, Mac, and Windows systems
• Knowledge of complex cloud environments, specifically providers such as Azure and Amazon AWS
• Ability to communicate complex technical findings, risks, and recommendations effectively to technical and non-technical audiences
• Proficient in written and spoken English
• Experience with leading Incident Response in a global organization with Cloud and Software as a Service exposure
• Experience with large scale and complex incidents of all types to include Advanced Threats, DDoS, insider, web and mobile applications, data ex-filtration etc
• Knowledge of Cybersecurity practices, operations, risk management processes, methods, architectural requirements, engineering and threats and vulnerabilities, including incident response methodologies
• Thorough knowledge of networking and security architecture
• Experience with ServiceNow Ticket Management and managing the SIR module