Sr. IT Security Analyst I

KFC•Louisville, KY

About The Position

The Senior Third-Party Risk Analyst I executes and continuously improves Yum!’s Third-Party Risk Management (TPRM) processes to identify, assess, monitor, and remediate cybersecurity risks associated with vendors and critical suppliers. The role independently manages complex third-party risk assessments, supports remediation and escalation, contributes to security contract reviews, and helps integrate critical supplier risk information into Enterprise Risk Management (ERM) processes. A key focus is optimizing and automating TPRM workflows and responsibly using AI. The role identifies opportunities to automate manual activities, configure and improve workflows, integrate risk data across systems, and use AI-assisted capabilities to improve assessment efficiency, data quality, reporting, and stakeholder experience while maintaining human oversight and governance. This is a senior individual-contributor role that serves as a resource to other team members and partners across Cybersecurity, Procurement, Legal, ERM, Technology, and business teams. Performance expectations include meeting assessment SLAs, improving workflow efficiency, implementing automation and AI-enabled improvements, maintaining accurate risk documentation, strengthening reporting, and improving stakeholder experience.

Requirements

Strong knowledge of third-party/vendor cybersecurity risk management principles and practices.
Experience performing cybersecurity risk assessments and evaluating vendor security controls.
Working knowledge of cybersecurity and risk frameworks and regulatory requirements relevant to third-party risk.
Experience managing risk findings through remediation, escalation, acceptance, and closure.
Understanding of security requirements used in vendor contracts and experience supporting contract or security-term reviews.
Demonstrated experience designing, configuring, or improving TPRM/GRC workflows and process automation.
Ability to translate TPRM processes into workflow requirements, business rules, approval paths, automated notifications, data integrations, and reporting.
Experience using automation to reduce manual TPRM activities and improve assessment throughput, consistency, or data quality.
Demonstrated ability to use AI and generative AI tools to improve TPRM workflows, risk analysis, and operational efficiency.
Ability to identify and implement AI-assisted automation opportunities across the third-party risk lifecycle, including intake, assessment analysis, evidence review, risk identification, issue management, reporting, and continuous monitoring.
Ability to apply AI responsibly while maintaining data protection, security, human oversight, validation, and governance controls.
Ability to evaluate AI-generated outputs for accuracy and ensure material third-party risk decisions receive appropriate human review.
Ability to analyze TPRM data and develop actionable metrics and reporting.
Strong analytical and problem-solving skills, including the ability to independently resolve complex third-party risk issues.
Strong written and verbal communication skills and ability to communicate cybersecurity risk effectively to technical and non-technical stakeholders.
Ability to build effective working relationships across Cybersecurity, Legal, Procurement, ERM, Technology, and business teams.
Bachelor’s degree in Cybersecurity, Risk Management, Information Technology, Controls/Audit, or a related field, or equivalent relevant experience.
Relevant professional experience in third-party risk management, vendor cybersecurity risk assessment, GRC, cybersecurity risk, or a related discipline.
Hands-on experience with a GRC/TPRM technology platform and its workflow/automation capabilities.
Hands-on experience using AI/GenAI tools in day-to-day cybersecurity, risk management, GRC, or TPRM activities.
Experience developing or improving repeatable risk-management processes and supporting technology workflows.
Experience working with cross-functional stakeholders in a complex enterprise environment.
Proficient in written and spoken English.

Responsibilities

Independently conduct and manage cybersecurity third-party risk assessments for vendors and critical suppliers, including complex or higher-risk engagements.
Analyze vendor security controls, issues, compensating controls, and residual risk to develop risk recommendations.
Drive identified third-party risks through remediation, acceptance, escalation, and closure in accordance with established processes.
Partner with Legal, Procurement, Cybersecurity, and business stakeholders on security requirements, contract reviews, and risk-related redlining.
Monitor third-party risk metrics, controls, issues, remediation activities, exceptions, and assessment performance.
Support integration of critical supplier risk information into Yum!’s ERM processes and reporting.
Develop and improve TPRM processes, procedures, assessment methodologies, reporting, and supporting tools.
Design, configure, implement, and optimize automated workflows for vendor intake, inherent-risk classification, assessment routing, evidence collection, control evaluation, issue management, approvals, reassessments, continuous monitoring, and offboarding.
Translate TPRM business requirements into workflow logic, automation rules, approval paths, notifications, integrations, dashboards, and reporting capabilities within applicable GRC/TPRM platforms.
Identify manual or repetitive TPRM activities and implement automation to improve cycle time, consistency, data quality, and scalability.
Use AI and generative AI to streamline appropriate TPRM activities, including evidence analysis, assessment summarization, risk identification, reporting, and stakeholder communications.
Apply human review, validation, data protection, security, and governance controls when using AI in TPRM processes or risk analysis.
Partner with Security Engineering, platform owners, and other technology teams to integrate TPRM processes with enterprise systems and data sources.
Develop dashboards and metrics showing assessment status, risk exposure, remediation performance, workflow bottlenecks, and program effectiveness.
Troubleshoot workflow and data-quality issues and recommend sustainable process or technology improvements.
Contribute to continuous improvement of TPRM standards, processes, tools, and controls.
Serve as a knowledgeable resource for less experienced team members and stakeholders on third-party cybersecurity risk practices.
Meet established assessment SLAs and maintain complete and accurate documentation for vendor risks, findings, remediation plans, and risk decisions.
Establish reporting on assessment backlog, aging risks, remediation status, and workflow bottlenecks.
Deliver workflow and AI-enabled improvements, document workflow logic and controls, troubleshoot automation exceptions, and demonstrate measurable improvements in efficiency, data quality, risk visibility, and stakeholder experience.