Sr. IT Security Analyst I at Yum! Brands in Louisville, KY

Job description

Role Summary The Senior Third-Party Risk Analyst I is responsible for executing and continuously improving Yum!’s Third-Party Risk Management (TPRM) processes to identify, assess, monitor, and remediate cybersecurity risks associated with vendors and critical suppliers. This role independently manages complex third-party risk assessments, supports risk remediation and escalation, contributes to security contract reviews, and helps integrate critical supplier risk information into Enterprise Risk Management (ERM) processes. A key component of this position is TPRM workflow optimization, automation, and responsible use of AI. The role identifies opportunities to automate manual activities, configure and improve TPRM workflows, integrate risk data across systems, and apply AI-assisted capabilities to improve assessment efficiency, data quality, reporting, and stakeholder experience while maintaining appropriate human oversight and governance. The position operates as a senior individual contributor and serves as a resource to other team members while partnering across Cybersecurity, Procurement, Legal, ERM, Technology, and business teams. Independently conduct and manage cybersecurity third-party risk assessments for vendors and critical suppliers, including more complex or higher-risk engagements. Analyze vendor security controls, identified issues, compensating controls, and residual risk to develop appropriate risk recommendations. Drive identified third-party risks through remediation, acceptance, escalation, and closure in accordance with established risk processes. Partner with Legal, Procurement, Cybersecurity, and business stakeholders on security requirements, contract reviews, and risk-related redlining. Monitor third-party risk metrics, controls, issues, remediation activities, exceptions, and assessment performance. Support integration of critical supplier risk information into Yum!’s ERM processes and reporting. Develop and improve TPRM processes, procedures, assessment methodologies, reporting, and supporting tools. Design, configure, implement, and optimize automated TPRM workflows supporting vendor intake, inherent risk classification, assessment routing, evidence collection, control evaluation, issue management, approvals, reassessments, continuous monitoring, and offboarding. Translate TPRM business requirements into workflow logic, automation rules, approval paths, notifications, integrations, dashboards, and reporting capabilities within applicable GRC/TPRM platforms. Identify manual or repetitive TPRM activities and implement automation that improves cycle time, consistency, data quality, and scalability. Leverage AI and generative AI capabilities to streamline appropriate TPRM activities such as evidence analysis, assessment summarization, risk identification, reporting, and stakeholder communications. Apply appropriate human review, validation, data protection, security, and governance controls when using AI in TPRM processes or risk analysis. Partner with Security Engineering, platform owners, and other technology teams to integrate TPRM processes with relevant enterprise systems and data sources. Develop dashboards and metrics that provide visibility into assessment status, risk exposure, remediation performance, workflow bottlenecks, and program effectiveness. Troubleshoot workflow and data-quality issues and recommend sustainable process or technology improvements. Contribute to continuous improvement of TPRM standards, processes, tools, and controls. Serve as a knowledgeable resource for less experienced team members and stakeholders on third-party cybersecurity risk practices. Required Skills Strong knowledge of third-party/vendor cybersecurity risk management principles and practices. Experience performing cybersecurity risk assessments and evaluating vendor security controls. Working knowledge of cybersecurity and risk frameworks and regulatory requirements relevant to third-party risk. Experience m