It takes powerful technology to connect our brands and partners with an audience of hundreds of millions of people. Whether you’re looking to write mobile app code, engineer the servers behind our massive ad tech stacks, or develop algorithms to help us process trillions of data points a day, what you do here will have a huge impact on our business—and the world.
A Little About Us
When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids".
About Our Team
The Vulnerability & Controls Operations team finds, triages, and tracks security weaknesses across cloud infrastructure, container orchestration (such as EKS), application frameworks, and core enterprise environments. We identify high-risk issues like zero-day vulnerabilities, supply chain threats, and cloud exposures using automated scanning and agentic workflows.
A Lot About You
We are looking for a Senior Security Engineer to serve as the lead for Vulnerability Management. This is a hybrid role that requires strong security engineering skills, operational leadership, and experience with automated remediation pipelines. You will be the engine behind the scenes - identifying and driving mitigation of vulnerabilities, overseeing vendor relationships, managing host-level and cloud vulnerability scanning, and utilizing Databricks and SBOM data to quantify risk at scale.
You will also stand on the front lines. You must have critical vulnerability handling experience. When a major threat emerges, you will help lead the coordination and remediation efforts alongside analysts, engineers, and senior leadership.
Key Responsibilities
- Direct the coordination, assessment, communication, and remediation of high-severity security vulnerabilities.
- Prioritize vulnerabilities based on specific context, distinct mitigating factors, threat intelligence feeds, CISA KEV, and Exploit Prediction Scoring System (EPSS) data.
- Use Databricks to query, parse, and analyze massive datasets to address vulnerabilities, identify trends, and generate insights for leadership reporting.
- Oversee technical requirements for vulnerability scanning platforms, configure scanners to match our changing environment, and manage vendor relationships to attain required features.
- Perform vulnerability scan, analysis, validation, and remediation activities across cloud, host, and application layers.
- Validate vulnerabilities discovered through enterprise scanners, container registry tools, IaC templates, and code analysis.
- Design, implement, and optimize AI-driven and agentic vulnerability management workflows (such as Agentic Defense and automated repository PR integrations) to automatically identify, prioritize, enrich, and track remediation of security findings.
- Utilize AI tools for core vulnerability management tasks such as parsing, summarizing, and triaging large datasets, researching emerging threats, zero-day vulnerabilities, and CVE analysis.
- Use AI-assisted analysis to identify systemic vulnerability trends and eliminate entire classes of vulnerabilities alongside developer platform teams.
- Own, maintain, and create operational process documentation and vulnerability handling runbooks regarding program execution.
- Work with product teams, developers, and system administrators to explain security risks, build safe defaults, and provide remediation guidance for vulnerabilities.
- Watch public and proprietary sources for vulnerability information, assess the impact of zero-day threats, recommend immediate action, and execute emergency response procedures.
- Track software supply chain exposure, establish processes for collecting and assessing Software Bill of Materials (SBOM) data across host, container, and cloud environments, and detect dependency confusion or malicious package attacks.
- Lead host OS and foundation-level automated vulnerability remediation initiatives, connecting vulnerability intelligence directly to repository Pull Requests (PRs) and automated ticketing workflows.
- Develop metrics, KPIs, and real-time operational dashboards for vulnerability management functions.
- Perform technical and non-technical compliance activities, as needed.
- Participate in an on-call rotation and provide after-hours support to drive the resolution of critical vulnerability handling.
Minimum Qualifications
- Bachelor’s degree in a technical discipline (i.e., Computer Science, Engineering, Information Security) or equivalent practical experience.
- 7+ years of experience in information security, specifically within vulnerability management or security engineering.
- Strong understanding of common application, network, and OS vulnerabilities (Linux, Windows, and OSX), patching, and attack patterns.
- Proven experience driving critical vulnerability remediation activities and leading coordination with stakeholders during high-pressure remediation efforts.
- Practical experience applying modern risk-based prioritization frameworks, including CVSS, Exploit Prediction Scoring System (EPSS), and CISA Known Exploited Vulnerabilities (KEV).
- Extensive experience with core vulnerability management scanners (i.e., Tenable, Nexpose, Qualys, AWS Inspector, GCP SCC, GitHub Advanced Security).
- Strong understanding of common cloud platforms (AWS, GCP) and container technologies (Kubernetes, AWS EKS, Docker), including container scanning and Infrastructure as Code (IaC) security.
- Deep understanding of supply chain risks, dependency confusion attacks, host/container SBOM ingestion, and automated vulnerability scanning/remediation across AWS, GCP, and on-prem environments.
- Proficiency with AI tools and agentic frameworks (e.g., automated PR generation, Agentic Defense, ticket enrichment) for core vulnerability management tasks.
- Proficiency with data analysis platforms, with experience using Databricks or similar tools to query and visualize large datasets to prioritize impactful vulnerabilities and reduce noise.
- Proficiency in Python or Go to build automation, work with APIs, and write clean, testable code.
- Experience with software development life cycle (SDLC), host-based security systems, networking, systems administration, and information security best practices.
- Familiarity with web application protocols, operating systems, and networking technologies.
- Ability to work independently with limited data and operate with a high sense of urgency to shift priorities quickly in a fast-paced environment.
Preferred Qualifications
- Certified Information Systems Security Professional (CISSP), CISM, or relevant cloud security certifications.
- Experience independently leading projects to completion.
- Intermediate to advanced capabilities with Databricks for log analysis and dashboard creation.
- Background in software development life cycle (SDLC) integration, automated PR gate security reviews, patch management, and vulnerability class elimination.
- Experience collaborating with cross-functional teams, software engineers, platform developers, and senior leadership.
Yahoo is proud to be an equal opportunity workplace. All qualified applicants will receive consideration for employment without regard to, and will not be discriminated against based on age, race, gender, color, religion, national origin, sexual orientation, gender identity, veteran status, disability or any other protected category. Yahoo will consider for employment qualified applicants with criminal histories in a manner consistent with applicable law. Yahoo is dedicated to providing an accessible environment for all candidates during the application process and for employees during their employment. If you need accessibility assistance and/or a reasonable accommodation due to a disability, please submit a request via the Accommodation Request Form (www.yahooinc.com/careers/contact-us.html) or call +1.866.772.3182. Requests and calls received for non-disability related issues, such as following up on an application, will not receive a response.
Yahoo has a high degree of flexibility around employee location and hybrid working. In fact, our flexible-hybrid approach to work is one of the things our employees rave about. Most roles don’t require specific regular patterns of in-person office attendance. If you join Yahoo, you may be asked to attend (or travel to attend) on-site work sessions, team-building, or other in-person events. When these occur, you’ll be given notice to make arrangements.
If you’re curious about how this factors into this role, please discuss with the recruiter.
The compensation for this position ranges from €72,600.00 - €121,000.00 /yr and will vary depending on factors such as your location, skills and experience. Your package may also include incentive compensation opportunities in the form of discretionary annual bonus or commissions. Our benefits include healthcare, pension and a flexible package you can adapt to your own needs.
Currently work for Yahoo? Please apply on our internal career site.
