Paranoids Senior Vulnerability Management Engineer

Yahoo; Ireland; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

Yahoo in Ireland is seeking a Senior Security Engineer to serve as the lead for Vulnerability Management on a contract basis. This hybrid role requires strong security engineering skills, operational leadership, and experience with automated remediation pipelines.

You will identify and drive mitigation of vulnerabilities, oversee vendor relationships, manage host- and cloud-scan programs, and use Databricks and SBOM data to quantify risk at scale while coordinating remediation with analysts and

Qualifications

• Bachelor's degree in a technical field or equivalent experience.
• 7+ years in information security, specifically vulnerability management or security engineering.
• Strong understanding of Linux/Windows/macOS vulnerabilities, patching, and attack patterns.
• Experience driving critical vulnerability remediation initiatives.

Responsibilities

• Direct coordination, assessment, communication and remediation of high-severity vulnerabilities.
• Prioritize vulnerabilities using threat intel, KEV, and EPSS data.
• Use Databricks to analyze large datasets and generate leadership insights.
• Oversee scanners and vendor relationships to meet evolving needs.
• Lead vulnerability remediation across cloud, host and application layers.
• Design AI-driven workflows to automate identification and triage of findings.
• Develop runbooks and operational docs for vulnerability handling.
• Participate in on-call rotations and after-hours support.

Skills

Vulnerability management

Security engineering

Automation pipelines

Cloud vulnerability scanning

Databricks

AI-driven workflows

Education

Bachelor's degree in Computer Science or Engineering

Tools

Databricks

Vulnerability scanners

IaC template analysis

Code analysis tools

Job description

It takes powerful technology to connect our brands and partners with an audience of hundreds of millions of people. Whether you're looking to write mobile app code, engineer the servers behind our massive ad tech stacks, or develop algorithms to help us process trillions of data points a day, what you do here will have a huge impact on our business-and the world.

A Little About Us

When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids".

About Our Team

The Vulnerability & Controls Operations team finds, triages, and tracks security weaknesses across cloud infrastructure, container orchestration (such as EKS), application frameworks, and core enterprise environments. We identify high-risk issues like zero-day vulnerabilities, supply chain threats, and cloud exposures using automated scanning and agentic workflows.

A Lot About You

We are looking for a Senior Security Engineer to serve as the lead for Vulnerability Management on a contract basis. This is a hybrid role that requires strong security engineering skills, operational leadership, and experience with automated remediation pipelines. You will be the engine behind the scenes - identifying and driving mitigation of vulnerabilities, overseeing vendor relationships, managing host-level and cloud vulnerability scanning, and utilizing Databricks and SBOM data to quantify risk at scale. You will also stand on the front lines. You must have critical vulnerability handling experience. When a major threat emerges, you will help lead the coordination and remediation efforts alongside analysts, engineers, and senior leadership.

Key Responsibilities

• Direct the coordination, assessment, communication, and remediation of high-severity security vulnerabilities.
• Prioritize vulnerabilities based on specific context, distinct mitigating factors, threat intelligence feeds, CISA KEV, and Exploit Prediction Scoring System (EPSS) data.
• Use Databricks to query, parse, and analyze massive datasets to address vulnerabilities, identify trends, and generate insights for leadership reporting.
• Oversee technical requirements for vulnerability scanning platforms, configure scanners to match our changing environment, and manage vendor relationships to attain required features.
• Perform vulnerability scan, analysis, validation, and remediation activities across cloud, host, and application layers.
• Validate vulnerabilities discovered through enterprise scanners, container registry tools, IaC templates, and code analysis.
• Design, implement, and optimize AI-driven and agentic vulnerability management workflows (such as Agentic Defense and automated repository PR integrations) to automatically identify, prioritize, enrich, and track remediation of security findings.
• Utilize AI tools for core vulnerability management tasks such as parsing, summarizing, and triaging large datasets, researching emerging threats, zero-day vulnerabilities, and CVE analysis.
• Use AI-assisted analysis to identify systemic vulnerability trends and eliminate entire classes of vulnerabilities alongside developer platform teams.
• Own, maintain, and create operational process documentation and vulnerability handling runbooks regarding program execution.
• Work with product teams, developers, and system administrators to explain security risks, build safe defaults, and provide remediation guidance for vulnerabilities.
• Watch public and proprietary sources for vulnerability information, assess the impact of zero-day threats, recommend immediate action, and execute emergency response procedures.
• Track software supply chain exposure, establish processes for collecting and assessing Software Bill of Materials (SBOM) data across host, container, and cloud environments, and detect dependency confusion or malicious package attacks.
• Lead host OS and foundation-level automated vulnerability remediation initiatives, connecting vulnerability intelligence directly to repository Pull Requests (PRs) and automated ticketing workflows.
• Develop metrics, KPIs, and real-time operational dashboards for vulnerability management functions.
• Perform technical and non-technical compliance activities, as needed.
• Participate in an on-call rotation and provide after-hours support to drive the resolution of critical vulnerability handling.

Minimum Qualifications

Bachelor's degree in a technical discipline (i.e., Computer Science, Engineering, Information Security) or equivalent practical experience. 7+ years of experience in information security, specifically within vulnerability management or security engineering. Strong understanding of common application, network, and OS vulnerabilities (Linux, Windows, and OSX), patching, and attack patterns. Proven experience driving critical vulnerability remediation activ