Paranoids Senior Product Security Engineer

About this role

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

A Little About Us When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids".

Within the Paranoids, the Product Security team is on the front line — embedded directly in how Yahoo's products get built. We live inside the software development lifecycle, from the first line of code to production, hunting for weaknesses before an adversary can. Threat Modeling, Static and Dynamic reviews, architecture review, bug bounty — this is where security meets engineering, and where we make sure "shipping fast" and "shipping safe" are never a tradeoff.

A Lot About You As a Paranoids Product Security Engineer, you have the opportunity to guide secure development for a product area and in addition, own and drive secure development initiatives affecting the overall enterprise.

Responsibilities • Independently lead application and mobile security assessments, from design to deployment, for key enterprise products.

• Drive threat modeling and risk assessments for high-impact systems, guiding engineering teams through secure design trade-offs.

• Partner with developers to embed security into build and release pipelines, and identify opportunities for automation.

• Develop and maintain internal security tooling and reusable frameworks to scale security across teams.

• Lead the remediation of critical vulnerabilities and help coordinate with incident response when needed.

• Mentor other security engineers and advocate for secure development practices across product and engineering teams.

• Collaborate cross-functionally with cloud security, infrastructure, and compliance teams to ensure holistic protection of applications and data.

• Stay informed on emerging threats, frameworks, and technologies, and proactively improve security posture through innovation.

Minimum Requirements • 5+ years of experience in application or product security, with demonstrated impact securing large-scale web and/or mobile applications.

• Deep understanding of secure application architecture, including authentication, authorization, encryption, and data protection across distributed systems.

• Proven hands-on experience performing threat modeling, secure design reviews, and code assessments for complex applications and APIs.

• Strong technical knowledge of web technologies (HTTP, TLS, CSP, cookies, OAuth, JWTs, GraphQL, REST APIs) and mobile security (iOS/Android app security models, keychains, secure storage, code obfuscation).

• Proficiency using and integrating application security tooling (SAST, DAST, IAST, dependency scanning, container scanning) into CI/CD pipelines.

• Practical experience with vulnerability triage and remediation workflows — coordinating across engineering teams to ensure timely fixes.

• Hands-on skills in at least one backend or systems programming language (e.g., Go, Java, Python, C#) and one frontend or mobile language (e.g., JavaScript/TypeScript, Swift, Kotlin).

• Experience contributing to or automating security testing and validation in continuous integration environments.

• Strong ability to communicate security risks and solutions clearly to engineers, managers, and non-technical stakeholders.

• Track record of driving security improvements across teams — through frameworks, documentation, training, or developer engagement.

• Working knowledge of AI/LLM application security fundamentals — including prompt injection, insecure output handling, sensitive data exposure through model inputs/outputs, and the OWASP Top 10 for LLM Applications.

• Experience reviewing applications that integrate LLMs or AI services, with the ability to identify common risks across AI pipelines (RAG, agentic tools, model APIs).

• Bachelors Degree in a relevant field or equivalent work experience

Preferred • Experience designing and maintaining secure frameworks or libraries used by multiple engineering teams.

• Familiarity with cloud-native application security (AWS/GCP/Azure), identity and access management, and secrets management.

• Experience leading or mentoring junior engineers in secure coding, threat modeling, and vulnerability management.

• Background with mobile application hardening, anti-tampering, and reverse engineering defenses.

• Understanding of supply chain security, including dependency management and integrity verification.

• Contributions to open-source security tools, security research, or industry standards bodies.

• Experience threat modeling AI/ML systems, including RAG pipelines, agentic workflows, and tool-use frameworks (e.g., Model Context Protocol).

• Familiarity with model supply chain security — model and dataset provenance, weight integrity, and risks of third-party models and embeddings.

• Hands-on experience with AI-assisted security tooling (e.g., LLM-powered code review, automated triage, security agents) and an understanding of their limitations and failure modes.

• Awareness of emerging AI security frameworks such as NIST AI RMF, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.

• Certifications such as GWEB, GWAPT, OSWE, or CSSLP a plus, but not required.

The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies ; exercising sound judgment ; working effectively, safely and inclusively with others ; exhibiting trustworthiness and meeting expectations ; and safeguarding business operations and brand integrity.

At Yahoo, we offer flexible hybrid work options that our e

Similar jobs

• Sr. Product Security Engineer — Medtronic · Mounds View, Minnesota, United States | Newton, Massachusetts, United States
• Sr. Product Security Engineer — Micron · Boise, ID - Main Site
• Sr. Product Security Engineer — Betterment · Betterment HQ - New York City
• Senior Product Security Engineer — Adobe · New York | San Jose
• Senior Product Security Engineer — Brunswick · Mettawa, IL
• Senior Product Security Engineer — Clear · New York, New York, United States
• Senior Product Security Engineer — Clickhouse · Remote
• Senior Product Security Engineer — FTI · WI - Menasha