Senior Corporate Product Assurance Engineer AI/SaaS Security

Yahoo Holdings Inc.; Richardson (TX); Híbrido; USD 128.000 - 267.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Flexible hybrid work options

Equal opportunity workplace

Descripción de la vacante

Yahoo is seeking a Paranoids Corporate Product Assurance Engineer to own end-to-end security reviews for corporate systems, including third-party SaaS, vendor integrations, AI/LLM products, and employee-facing tools. You will manage intake, determine security requirements, and close reviews with documented dispositions within SLAs.

You will assess AI/LLM integrations for prompt injection and data exposure, ensure MFA and access controls, and align with NIST/OWASP/CIS frameworks.

Formación

• 6+ years of experience in product, application, or corporate/enterprise security, including 2+ years owning security reviews or an assurance function end to end.
• Demonstrated ownership of a review queue at volume - triage, prioritization, and closing reviews to a documented disposition under a service level.
• Strong grasp of third-party and SaaS security assessment: tenant configuration, SSO and provisioning integration, data flows across trust boundaries, subprocessors, and vendor data‑handling commitments.
• Working knowledge of AI/LLM application security - prompt injection, insecure output handling, sensitive data exposure through model inputs and outputs, and the OWASP Top 10 for LLM Applications.
• Identity and access review experience with Okta or comparable IdP: MFA enforcement, provisioning and deprovisioning, service accounts and non-human identity, least-privilege review.
• Understanding of enterprise and collaboration infrastructure at scale - productivity suites, source control, ticketing, HR/finance platforms, and data exposure patterns.
• Familiarity with industry security frameworks (NIST CSF, NIST AI RMF, OWASP, CIS) and applying them as control-based critique.
• Ability to translate a technical description into a control-based risk decision for non-security stakeholders.
• Scripting and automation of review workflow (e.g., Python) against system APIs.
• Strong stakeholder skills and clear communication under delivery pressure.
• Bachelors Degree in a relevant field or equivalent work experience

Responsabilidades

• Own Paranoid Security Reviews for corporate systems end to end from intake to disposition with SLA adherence.
• Review connections and data flows across trust boundaries: authentication, authorization, tokens, and audit coverage.
• Assess AI/LLM integrations for prompt injection and data exposure risks; evaluate retention and residency in vendor-hosted inference.
• Run baseline configuration reviews and annual checks; reconcile SaaS inventory with review history.
• Ensure evidence, encryption, logging, and MFA controls meet Paranoids standards and industry frameworks.
• Write clear dispositions that explain observations, implications, and closure owners.
• Improve triage, risk tiering, enrichment, and guardrails to speed reviews without sacrificing quality.
• Verify AI-assisted outputs before final dispositions; maintain explainability of approvals.
• Collaborate across teams: Third-Party Risk, Privacy, Legal, Enterprise Identity, Cloud/Network Security, MCP Gateway.
• Drive efficiency through rubrics, templates, and reusable control sets.
• Cross-train peers to avoid single-point dependency.

Conocimientos

Security reviews ownership

SLA-driven reviews

AI/LLM security

Okta MFA

Python scripting

Educación

Bachelors Degree or equivalent

Descripción del empleo

Yahoo is seeking a Paranoids Corporate Product Assurance Engineer to own end-to-end security reviews for corporate systems, including third-party SaaS, vendor integrations, AI/LLM products, and employee-facing tools. You will manage intake, determine security requirements, and close reviews with documented dispositions within SLAs.

You will assess AI/LLM integrations for prompt injection and data exposure, ensure MFA and access controls, and align with NIST/OWASP/CIS frameworks.