Security & Cyber Incident Response Engineer

KFC•Louisville, KY

About The Position

Yum! Brands has a new opportunity for an Information Security & Cyber Incident Response Engineer. This role gives a successful candidate the opportunity to influence Yum’s business at a global level by working to drive the Global Cybersecurity strategy by further progressing the incident response program. The position partners with various Information Technology teams, business functions, and other key stakeholders to gain commitment and alignment to identify and manage risk. In this role, you will have the opportunity to learn our business from the ground up while working on cutting edge technologies. The ideal candidate will be protecting enterprise systems and information by responding to security threats and incidents, working autonomously or as part of a geographically diverse team to detect, examine and resolve cybersecurity incidents globally. For this role, the ideal candidate will need to have the ability to work extended hours including nights, weekends, and holidays with little notice to facilitate incident response. This role also requires participation in after-hours on-call rotation, including the ability to investigate reported incidents within 30 minutes of notice.

Requirements

Bachelor’s degree in computer science, information security or related field
Industry certifications such as CompTIA Security+, CompTIA CySA+, GIAC Certified Incident Handler (GCIH)
5+ years of cybersecurity experience, including significant hands-on experience in security incident response, security operations, or equivalent relevant experience
Knowledge of incident response processes (detection, triage, incident research, remediation, and reporting)
Knowledge of administration and use of Linux, Mac, and Windows systems
Knowledge of complex cloud environments, specifically providers such as Azure and Amazon AWS
Ability to communicate complex technical findings, risks, and recommendations effectively to technical and non-technical audiences
Proficient in written and spoken English

Nice To Haves

Experience with leading Incident Response in a global organization with Cloud and Software as a Service exposure
Experience with large scale and complex incidents of all types to include Advanced Threats, DDoS, insider, web and mobile applications, data ex-filtration etc.
Knowledge of Cybersecurity practices, operations, risk management processes, methods, architectural requirements, engineering and threats and vulnerabilities, including incident response methodologies
Thorough knowledge of networking and security architecture
Experience with ServiceNow Ticket Management and managing the SIR module

Responsibilities

Lead technical investigation activities across endpoints, servers, networks, cloud environments, identities, applications, and other enterprise platforms to identify affected assets, accounts, data, indicators of compromise, attack vectors, and root cause.
Coordinate and execute technical containment, eradication, and remediation activities, including endpoint isolation, account disablement, access revocation, IOC blocking, credential resets, malware removal, vulnerability remediation, system reconfiguration, and other corrective actions as appropriate.
Maintain a comprehensive incident timeline and document investigative findings, technical decisions, response actions, approvals, communications, and evidence references throughout the incident lifecycle.
Partner with Security Operations, Cyber Threat Intelligence, Digital Forensics, Security Engineering, Vulnerability Management, Threat Hunting, Architecture, infrastructure teams, and other technical stakeholders to coordinate investigation and response activities.
Serve as Incident Response Lead for complex and high-severity cybersecurity incidents, independently coordinating technical workstreams, establishing investigative priorities, driving technical decisions, managing dependencies, and escalating material risks and decisions to cybersecurity leadership.
Apply threat intelligence and adversary behavior analysis during active investigations to reconstruct attack paths, identify attacker objectives, assess potential additional compromise, and inform containment and remediation strategies.
Lead and participate in incident response exercises, tabletop simulations, and post-incident reviews; identify capability gaps and own or drive continuous improvements to incident response playbooks, procedures, investigation methodologies, automation, tooling, monitoring, and technical controls.
Independently develop and coordinate technical response strategies for complex incidents, including situations where established playbooks, procedures, or precedent may not fully address the circumstances, exercising judgment based on incident type, severity, business impact, operational risk, evidence-preservation requirements, and business continuity considerations.
Validate the effectiveness of containment and remediation actions, confirm that residual indicators of compromise or attacker persistence have been removed, and ensure corrective actions address identified root causes and reduce the likelihood of recurrence.
Coordinate secure recovery of affected systems and services with infrastructure, application, cloud, and business teams, including validation of rebuilt systems, restored data, security configurations, and enhanced controls before returning systems to normal operation.
Coordinate technical response activities with third-party vendors, service providers, cloud providers, and external incident response partners in accordance with established incident response procedures and contractual requirements.
Maintain accurate, timely, and auditable Security Incident Records (SIRs) within ServiceNow, including incident scope, severity, investigation findings, actions taken, decisions, status updates, evidence references, and closure documentation.
Communicate technical findings, risks, incident impact, response options, dependencies, and implications of technical decisions to cybersecurity leadership, business stakeholders, executive leadership, and other technical and non-technical audiences as appropriate.
Identify systemic security control, monitoring, architecture, and operational gaps discovered through investigations and influence partner teams to implement corrective actions that reduce enterprise cybersecurity risk and the likelihood of recurrence.
Serve as a technical resource and mentor for less-experienced security engineers and analysts, providing guidance on investigation methodology, technical analysis, incident response decisions, and complex escalations.