Paranoids Senior Container Security Engineer

Yahoo; United States; Hybrid; USD 128,000 - 267,000; Full time

Job summary

Yahoo’s security team, The Paranoids, seeks a hands-on Container Security Engineer to protect container workloads across cloud and on‑prem environments. You’ll help translate security findings into fixes for engineering teams, build secure baselines, and advance the container security program.

You will partner with platform engineering, vulnerability operations, and product teams to move milestones from design to production, while maturing AI-assisted security workflows and reporting progress to

Qualifications

• Bachelor's degree in a technical discipline (e.g., Computer Science, Engineering, Information Security) or equivalent practical experience.
• 5+ years of information security experience with at least 3 years in container security, cloud security engineering, or DevSecOps.
• Hands-on experience operating container vulnerability scanning and SBOM tooling in CI/CD (Grype, Syft, Trivy, Anchore, Snyk Container) including CVE triage.
• GCP container security experience with securing GKE clusters, Cloud Run, Artifact Registry, and Security Command Center.
• On‑premises host hardening and container runtimes (Docker, containerd) on Linux, Windows; RBAC and Kubernetes security basics.

Responsibilities

• Operate and improve container image scanning and SBOM tooling in CI/CD pipelines.
• Develop container security baselines and best practices based on industry standards.
• Build detections to enforce container security baselines and route findings to owning teams.
• Create secure-by-default paved roads, hardened base images, policy-as-code guardrails, and self-service tooling to drive adoption.
• Act as hands-on domain expert for securing container workloads on GCP (GKE, Cloud Run) and AWS (EKS, ECS/Fargate, ECR).
• Secure on‑premises Linux, Baremetal, Windows hosts and ensure OS patches and firmware are current.

Skills

Container security

Cloud security

DevSecOps

Python

SQL

Education

Bachelor's degree in CS/Engineering

Tools

Grype

Syft

Trivy

Anchore

Snyk Container

GKE

Cloud Run

Artifact Registry

Kubernetes

Docker

Job description

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

A Little About Us

Yahoo reaches hundreds of millions of people every day, and that scale makes us a constant target for attackers of every kind, at every layer of our systems. Our job is to protect our users and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo, known as The Paranoids. Within Cyber Resilience, our team is responsible for the security of the containers, clusters, and cloud and on-premises hosts that run Yahoo's products, and we're growing the team to take that program further.

A Lot About You

We're looking for someone who wants to go deep on container security as part of a hands-on team. Working alongside the engineers who lead our container security program, you'll help keep container workloads secure across our cloud and on-premises environments, turn security findings into fixes that engineering teams can act on, and help the program keep maturing. You'll build relationships across platform and product teams to get security work prioritized and delivered, make pragmatic calls that balance security with developer velocity, and stay curious about the container threat landscape with a bias toward fixing root causes.

Responsibilities

• Operating and improving container image scanning and SBOM tooling in CI/CD pipelines


• Developing container security baselines and best practices based on industry standards


• Building detections to enforce container security baselines and routing findings to the teams that own the affected workloads


• Building secure-by-default paved roads for container teams, curated hardened base images, policy-as-code guardrails, and self-service tooling – driving developer adoption, not only enforcement


• Acting as the hands-on domain specialist for securing container workloads on GCP (GKE, Cloud Run, Artifact Registry) and AWS (EKS, ECS/Fargate, ECR)


• Acting as the hands-on domain specialist for securing the on-premises Linux, Baremetal, Windows, and other distro hosts that container workloads run on, including host hardening, container runtime configuration, and keeping OS patches and server firmware current


• AI-Augmented Automation: Develop and refine AI-assisted workflows using enterprise AI tools (e.g., Claude) to automate vulnerability triage and security policy updates


• Reviewing and validating AI-generated policy changes, queries, and triage decisions before they reach production, to make sure the output is accurate and doesn't block legitimate builds or let a real vulnerability through


• Partnering with platform engineering, vulnerability operations, and product teams to move container security milestones from design to production


• Reporting on container fleet risk posture, remediation progress, and program metrics to security leadership


• This role is what you make of it. Our container security program has a multi-year roadmap ahead of it, and you will have a real voice in how it evolves and where it goes next.

Basic Qualifications

• Bachelor's degree in a technical discipline (i.e., Computer Science, Engineering, Information Security) or equivalent practical experience.


• 5+ years of experience in information security, with at least 3 years focused on container security, cloud security engineering, or DevSecOps.


• Hands-on experience operating container vulnerability scanning and SBOM tooling in CI/CD, such as Grype, Syft, Trivy, Anchore, or Snyk Container, including CVE triage and working with SBOM formats like SPDX or CycloneDX


• GCP container security expertise, including hands-on experience securing GKE clusters and Cloud Run services, scanning and governing images in Artifact Registry, and working with Security Command Center findings for container workloads


• On-premises host expertise, including hardening enterprise Linux, Baremetal, Windows and other distributions (e.g., RHEL or its derivatives), running container runtimes such as containerd or Docker on bare metal, kernel isolation features like namespaces, cgroups, and seccomp


• Working knowledge of Kubernetes security, including RBAC, namespaces, pod security, and admission control, and how those controls differ across managed Kubernetes offerings


• AWS experience with container workloads, including ECS, Fargate, EKS, and ECR, and the IAM model that governs them


• Strong understanding of container image security fundamentals: base image hygiene, image freshness, end-of-life distribution risk, and image signing and provenance


• Proficiency in Python and SQL, with the ability to build and maintain data pipelines on platforms such as Databricks or Spark without dedicated engineering suppor


• Comfortable using enterprise AI tools (e.g., Claude, Gemini) in day-to-day security work – for example prompt design, vulnerability triage, query generation, or security workflow automation

Preferred Qualifications

• A relevant certification, such as Google Cloud Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), or AWS Certified Security Specialty, or equivalent hands-on experience.


• Experience with Binary Authorization, Sigstore/cosign, or policy engines such as OPA Gatekeeper or Kyverno to enforce image signing and admission policy.


• Familiarity with Kubernetes network policies and east-west segmentation (NetworkPolicy, service mesh / mTLS) to limit lateral movement.


• Experience evaluating or operating container runtime security tools, including agents for serverless container platforms.


• Experience running Kubernetes or other container platforms on bare metal or private cloud infrastructure, and managing server firmware (BIOS/UEFI, BMC) patching and lifecycle.


• Familiarity with CIS Benchmarks or similar hardening standards for Linux, Docker, and Kubernetes.


• Background in enterprise vulnerability management programs, including severity-based SLAs, exception handling, and remediation tracking at scale.


• Experience prioritizing container vulnerabilities by exploitability and reachability in running workloads.


• Experience with infrastructure as code and IaC scanning, such as Terraform and Checkov.


• Practical experience building AI-assisted security workflows; prompt and agent-harness design (tool integration, context, and guardrails) and automating parts of a security operations pipeline.

The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies; exercising sound judgment; working effectively, safely and inclusively with others; exhibiting trustworthiness and meeting expectations; and safeguarding business operations and brand integrity.

At Yahoo, we offer flexible hybrid work options that our employees love! While most roles don’t require regular office attendance, you may occasionally be asked to attend in-person events or team sessions. You’ll always get notice to make arrangements.

Yahoo is proud to be an equal opportunity workplace. All qualified applicants will receive consideration for employment without regard to, and will not be discriminated against based on age, race, gender, color, religion, national origin, sexual orientation, gender identity, veteran status, disability or any other protected category. Yahoo will consider for employment qualified applicants with criminal histories in a manner consistent with applicable law.

Yahoo is dedicated to providing an accessible environment for all candidates during the application process and for employees during their employment. If you need accessibility assistance and/or a reasonable accommodation due to a disability, please submit a request via the Accommodation Request Form (www.yahooinc.com/careers/contact-us.html) or call +1.866.772.3182. Requests and calls received for non-disability related issues, such as following up on an application, will not receive a response.

We believe that a diverse and inclusive workplace strengthens Yahoo and deepens our relationships. When you support everyone to be their best selves, they spark discovery, innovation and creativity. Among other efforts, our 11 employee resource groups (ERGs) enhance a culture of belonging with programs, events and fellowship that help educate, support and create a workplace where all feel welcome.

The compensation for this position ranges from $128,250.00 - $266,875.00/yr and will vary depending on factors such as your location, skills and experience. The compensation package may also include incentive compensation opportunities in the form of discretionary annual bonus or commissions. Our comprehensive benefits include healthcare, a great 401k, backup childcare, education stipends and much (much) more.

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.