Yum! Brands Security Team

Open security roles at Yum! Brands, and what we know about the team behind them.

restaurants · 40000 employees · 4 open roles. Updated October 16, 2026.

Open roles (4)

Yum! Brands

“"Partner with US teams to provide security guidance as a subject matter expert around application security"– Security...”

Yum! Brands

“"Partner with US teams to provide security guidance as a subject matter expert around application security"– Security...”

Yum! Brands

“"Partner with US teams to provide security guidance as a subject matter expert around application security"– Security...”

Yum! Brands

“"Partner with US teams to provide security guidance as a subject matter expert around application security"– Security...”

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

How they approach application security

Stated AppSec Mission: "Partner with US teams to provide security guidance as a subject matter expert around application security"– Security Engineer II .
Developer Enablement vs. Gatekeeping: "Conduct awareness campaigns with engineering teams to ensure application development adheres to YUM! Global Technology Risk Management..."– Security Engineer II .
Risk Philosophy: "Aligning with a risk-based approach, collaborate with third-party engineers...to identify, prioritize, and remediate vulnerabilities"– Security Engineer II .
Stated Pain Points or Goals: "Conduct threat modeling exercises to identify potential risks at the design and architecture stages"– Security Engineer III .
Gaps & Contradictions: No public statements found regarding 'paved road' or 'developer-first' branding.

The team

Key Public-Facing Leaders: Ethan Steiger, Chief Security Officer
Key Quote: "CHIEF SECURITY OFFICER with 25 years combined experience in establishing respected…"– Ethan Steiger LinkedIn .
Active AppSec Job Postings (as_of:): Count: 2 (Security Engineer II and III).
Common Skill/Tool Patterns: Emphasis on SAST, DAST, container scanning, and threat modeling.
Gaps & Contradictions: Specific reporting lines (e.g., AppSec to CISO) are not explicitly defined in public profiles.

What they're working on

Security Champions Program: No Evidence Found. "Shift Left"in Practice: "Conduct threat modeling exercises to identify potential risks at the design and architecture stages"– Security Engineer III .
Vulnerability Management Process: Intake: "...scanning tools for containers, SAST, DAST, and crowd sourced pen testing."– Security Engineer II .
Triage/Remediation: "...collaborate with third-party engineers...to identify, prioritize, and remediate vulnerabilities"– Security Engineer II .
Secure SDLC Artifacts: "...ensure application development adheres to YUM! Global Technology Risk Management development standards."– Security Engineer II .
Gaps & Contradictions: No evidence of a formal 'Security Champions' program or specific remediation SLAs (e.g., 30-day fix) found in public data.