Senior Container Security Engineer: Cloud & On-Prem Defender

Yahoo Holdings Inc.; New York (NY); Hybrid; USD 128,000 - 267,000; Full time

Job summary

Yahoo is seeking a hands-on Container Security Engineer to tighten security across cloud and on‑premises container workloads. You will implement image scanning, SBOM tooling, and security baselines while partnering with platform and product teams to push secure changes into production.

You will leverage AI-assisted workflows for vulnerability triage, enforce governance in GCP and AWS environments, and contribute to a multi‑year container security roadmap with a strong emphasis on practical fixes

Qualifications

• Bachelor's degree in a technical discipline or equivalent practical experience.
• 5+ years of information security experience with at least 3 years on container/security.
• Hands-on experience operating container scanning tooling in CI/CD (Grype, Syft, Trivy, Anchore, Snyk).
• GCP container security expertise with GKE and Cloud Run, Artifact Registry governance.
• On-premises host hardening across Linux, Windows, and Baremetal environments.

Responsibilities

• Operate and improve container image scanning and SBOM tooling in CI/CD pipelines.
• Develop container security baselines and best practices based on industry standards.
• Build detections to enforce baselines and route findings to owning teams.
• Secure the on-prem and cloud container workloads across environments.
• Report container fleet risk posture and remediation progress to security leadership.

Skills

Python

SQL

Kubernetes security

CI/CD tooling

Education

Bachelor's degree in a technical field

Tools

Grype

Syft

Trivy

Anchore

Snyk Container

Job description

Yahoo is seeking a hands-on Container Security Engineer to tighten security across cloud and on‑premises container workloads. You will implement image scanning, SBOM tooling, and security baselines while partnering with platform and product teams to push secure changes into production.

You will leverage AI-assisted workflows for vulnerability triage, enforce governance in GCP and AWS environments, and contribute to a multi‑year container security roadmap with a strong emphasis on practical fixes