Paranoids Senior Product Security Engineer

Yahoo is a trusted guide for millions, helping them achieve their online goals through a portfolio of iconic products. The Paranoids Product Security Engineer will lead application and mobile security assessments, drive secure development initiatives, and collaborate with cross-functional teams to ensure the security of Yahoo's products.

Responsibilities:

• Independently lead application and mobile security assessments, from design to deployment, for key enterprise products
• Drive threat modeling and risk assessments for high-impact systems, guiding engineering teams through secure design trade-offs
• Partner with developers to embed security into build and release pipelines, and identify opportunities for automation
• Develop and maintain internal security tooling and reusable frameworks to scale security across teams
• Lead the remediation of critical vulnerabilities and help coordinate with incident response when needed
• Mentor other security engineers and advocate for secure development practices across product and engineering teams
• Collaborate cross-functionally with cloud security, infrastructure, and compliance teams to ensure holistic protection of applications and data
• Stay informed on emerging threats, frameworks, and technologies, and proactively improve security posture through innovation

Requirements:

• 5+ years of experience in application or product security, with demonstrated impact securing large-scale web and/or mobile applications
• Deep understanding of secure application architecture, including authentication, authorization, encryption, and data protection across distributed systems
• Proven hands-on experience performing threat modeling, secure design reviews, and code assessments for complex applications and APIs
• Strong technical knowledge of web technologies (HTTP, TLS, CSP, cookies, OAuth, JWTs, GraphQL, REST APIs) and mobile security (iOS/Android app security models, keychains, secure storage, code obfuscation)
• Proficiency using and integrating application security tooling (SAST, DAST, IAST, dependency scanning, container scanning) into CI/CD pipelines
• Practical experience with vulnerability triage and remediation workflows - coordinating across engineering teams to ensure timely fixes
• Hands-on skills in at least one backend or systems programming language (e.g., Go, Java, Python, C#) and one frontend or mobile language (e.g., JavaScript/TypeScript, Swift, Kotlin)
• Experience contributing to or automating security testing and validation in continuous integration environments
• Strong ability to communicate security risks and solutions clearly to engineers, managers, and non-technical stakeholders
• Track record of driving security improvements across teams - through frameworks, documentation, training, or developer engagement
• Working knowledge of AI/LLM application security fundamentals - including prompt injection, insecure output handling, sensitive data exposure through model inputs/outputs, and the OWASP Top 10 for LLM Applications
• Experience reviewing applications that integrate LLMs or AI services, with the ability to identify common risks across AI pipelines (RAG, agentic tools, model APIs)
• Bachelors Degree in a relevant field or equivalent work experience
• Experience designing and maintaining secure frameworks or libraries used by multiple engineering teams
• Familiarity with cloud-native application security (AWS/Google Cloud Platform/Azure), identity and access management, and secrets management
• Experience leading or mentoring junior engineers in secure coding, threat modeling, and vulnerability management
• Background with mobile application hardening, anti-tampering, and reverse engineering defenses
• Understanding of supply chain security, including dependency management and integrity verification
• Contributions to open-source security tools, security research, or industry standards bodies
• Experience threat modeling AI/ML systems, including RAG pipelines, agentic workflows, and tool-use frameworks (e.g., Model Context Protocol)
• Familiarity with model supply chain security - model and dataset provenance, weight integrity, and risks of third-party models and embeddings
• Hands-on experience with AI-assisted security tooling (e.g., LLM-powered code review, automated triage, security agents) and an understanding of their limitations and failure modes
• Awareness of emerging AI security frameworks such as NIST AI RMF, MITRE ATLAS, and the OWASP Top 10 for LLM Applications
• Certifications such as GWEB, GWAPT, OSWE, or CSSLP a plus, but not required