Sr. IT Security Analyst I

Role Summary The Senior Third-Party Risk Analyst I is responsible for executing and continuously improving Yum!’s Third-Party Risk Management (TPRM) processes to identify, assess, monitor, and remediate cybersecurity risks associated with vendors and critical suppliers. This role independently manages complex third-party risk assessments, supports risk remediation and escalation, contributes to security contract reviews, and helps integrate critical supplier risk information into Enterprise Risk Management (ERM) processes. A key component of this position is TPRM workflow optimization, automation, and responsible use of AI. The role identifies opportunities to automate manual activities, configure and improve TPRM workflows, integrate risk data across systems, and apply AI-assisted capabilities to improve assessment efficiency, data quality, reporting, and stakeholder experience while maintaining appropriate human oversight and governance. The position operates as a senior individual contributor and serves as a resource to other team members while partnering across Cybersecurity, Procurement, Legal, ERM, Technology, and business teams.
Required Skills
- Strong knowledge of third-party/vendor cybersecurity risk management principles and practices.

- Experience performing cybersecurity risk assessments and evaluating vendor security controls.

- Working knowledge of cybersecurity and risk frameworks and regulatory requirements relevant to third-party risk.

- Experience managing risk findings through remediation, escalation, acceptance, and closure.

- Understanding of security requirements used in vendor contracts and experience supporting contract/security-term reviews.

- Demonstrated experience designing, configuring, or improving TPRM/GRC workflows and process automation.

- Ability to translate TPRM processes into workflow requirements, business rules, approval paths, automated notifications, data integrations, and reporting.

- Experience using automation to reduce manual TPRM activities and improve assessment throughput, consistency, or data quality.

- Demonstrated ability to use AI and generative AI tools to improve TPRM workflows, risk analysis, and operational efficiency.

- Ability to identify and implement appropriate AI-assisted automation opportunities across the third-party risk lifecycle, including vendor intake, assessment analysis, evidence review, risk identification, issue management, reporting, and continuous monitoring.

- Ability to apply AI responsibly while maintaining appropriate data protection, security, human oversight, validation, and governance controls.

- Ability to evaluate AI-generated outputs for accuracy and ensure material third-party risk decisions receive appropriate human review.

- Ability to analyze TPRM data and develop actionable metrics and reporting.

- Strong analytical and problem-solving skills with the ability to independently resolve complex third-party risk issues.

- Strong written and verbal communication skills and ability to communicate cybersecurity risk effectively to technical and non-technical stakeholders.

- Ability to build effective working relationships across Cybersecurity, Legal, Procurement, ERM, Technology, and business teams.
Qualifications
- Bachelor’s degree in Cybersecurity, Risk Management, Information Technology, Controls/Audit, or a related field, or equivalent relevant experience.

- Relevant professional experience in third-party risk management, vendor cybersecurity risk assessment, GRC, cybersecurity risk, or a related discipline.

- Hands-on experience with a GRC/TPRM technology platform and associated workflow/automation capabilities.

- Hands-on experience using AI/GenAI tools as part of day-to-day cybersecurity, risk management, GRC, or TPRM activities.

- Experience developing or improving repeatable risk-management processes and supporting technology workflows.

- Experience working with cross-functional stakeholders in a complex enterprise environment.

- Proficient in written and spoken English.

Key Performance Indicators (KPIs) KPIs are organized by time horizon and functional area to emphasize measurable outcomes in technical delivery, TPRM risk management, AI/automation, operational efficiency, and stakeholder impact. Short-Term Outcomes — 3–6 Months
- Independently manage assigned third-party assessments and meet established assessment SLAs for at least 90% of assigned reviews.

- Document and baseline the current TPRM workflow, identifying the highest-value opportunities for automation, AI enablement, and process improvement.

- Implement or materially contribute to at least 2 TPRM workflow, automation, or AI-enabled improvements addressing manual handoffs, routing, notifications, evidence collection, approvals, reporting, or issue management.

- Maintain complete and accurate documentation for assigned vendor risks, findings, remediation plans, and risk decisions.

- Establish reporting that identifies assessment backlog, aging risks, remediation status, and workflow bottlenecks.
Long-Term Outcomes — 6–12+ Months
- Improve TPRM assessment cycle time by a target of 15–25% through workflow optimization, automation, AI enablement, or process improvements, subject to validated baseline measurement.

- Automate or eliminate at least 20% of identified repetitive/manual TPRM process steps within the role’s area of responsibility.

- Achieve at least 95% on-time completion of assigned vendor risk assessments against established SLAs.

- Achieve at least 90% on-time remediation or documented escalation of vendor risk issues within established target dates.

- Demonstrate measurable improvement in TPRM data completeness, consistency, and reporting quality.

- Maintain reliable integration and reporting of applicable critical supplier risk information into ERM processes.
Functional Area — TPRM Technical Delivery & Automation
- Deliver workflow enhancements that measurably reduce manual intervention and unnecessary process handoffs.

- Maintain documented workflow logic, automation rules, ownership, dependencies, and exception paths.

- Ensure automated workflows accurately implement approved TPRM processes and control requirements.

- Troubleshoot and resolve workflow failures, data-quality issues, and automation exceptions within agreed service targets.
Functional Area — AI Enablement & Responsible Use
- Identify and implement 2–3 measurable AI-enabled TPRM improvements over the performance period, such as evidence analysis, assessment summarization, risk identification, reporting, or workflow assistance.

- Demonstrate measurable improvement in cycle time, manual effort, data quality, or risk visibility from AI-enabled capabilities.

- Maintain documented human-review and validation controls for material AI-assisted TPRM outputs and decisions.

- Demonstrate adherence to applicable data protection, security, and AI governance requirements for TPRM use cases.

Functional Area — Risk Management & Operational Efficiency
- Produce consistent, defensible vendor risk assessments supported by appropriate evidence.

- Improve visibility into open third-party risks, overdue remediation activities, and critical supplier exposure.

- Demonstrate measurable reductions in aged assessments and remediation items.

- Provide actionable TPRM metrics that enable Cybersecurity leadership to identify trends and prioritize risk treatment.
Functional Area — Stakeholder Impact
- Maintain effective partnerships with Procurement, Legal, ERM, Technology, and business stakeholders.

- Clearly communicate complex third-party cybersecurity risks and recommended actions to technical and non-technical audiences.

- Demonstrate measurable improvement in stakeholder experience through more efficient intake, assessment, remediation, and reporting workflows.