Senior Web Security Engineer - WAF & Cloud APIs (Remote)

YUM; Northern (KY); Hybrid; USD 118,000 - 148,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Paid time off

Volunteer time off

Job summary

Yum! Brands is seeking a Sr. Security Engineer to join its Cybersecurity Engineering team, focused on web app security, cloud tech, and enterprise-scale engineering. Remote.

The role emphasizes designing, implementing, and optimizing WAF protections (Akamai preferred) and securing enterprise web apps and APIs against OWASP Top 10, DDoS, bots, and API attacks. Collaboration with multiple teams is key.

Qualifications

• Experience securing enterprise web applications and APIs.
• Knowledge of WAF technologies and DDoS protection.
• Experience with certificate management and production troubleshooting.
• Ability to script (PowerShell, Python, Bash).
• Security certifications such as CISSP, Security+ or Akamai certifications are a bonus.

Responsibilities

• Design, implement, and optimize WAF protections using Akamai (or similar platforms).
• Secure enterprise web applications and APIs against modern cyber threats.
• Manage CDN configurations and public TLS certificate lifecycle.
• Investigate security incidents, tune security policies, and improve platform performance.
• Drive automation, operational excellence, and continuous improvement.
• Partner with engineering, cloud, networking, and business teams to deliver secure, scalable solutions.

Skills

Web application security

HTTP/HTTPS security

TLS/SSL

DNS and CDN

REST APIs security

Scripting / Automation

Incident response

WAF experience

Tools

Akamai WAF

Cloudflare

Imperva

F5

AWS WAF

Job description

Yum! Brands is seeking a Sr. Security Engineer to join its Cybersecurity Engineering team, focused on web app security, cloud tech, and enterprise-scale engineering. Remote.

The role emphasizes designing, implementing, and optimizing WAF protections (Akamai preferred) and securing enterprise web apps and APIs against OWASP Top 10, DDoS, bots, and API attacks. Collaboration with multiple teams is key.