Senior Product Security Engineer — Lead Secure Dev

Yahoo; United States; Hybrid; USD 128,250 - 266,875; Full time

Job summary

Yahoo is seeking a Paranoids Product Security Engineer to lead application and mobile security assessments, from design to deployment, across key enterprise products. You will drive threat modeling and risk assessments, guiding engineering through secure design trade-offs.

You will partner with developers to embed security into build/release pipelines, develop internal security tooling, and coordinate with incident response on remediation.

Qualifications

• 5+ years in application or product security with impact securing large-scale web/mobile apps.
• Deep understanding of secure app architecture and data protection across distributed systems.
• Hands-on threat modeling, secure design reviews, and code assessments for complex apps/APIs.

Responsibilities

• Independently lead security assessments from design to deployment for key enterprise products.
• Drive threat modeling and risk assessments for high-impact systems; guide engineering on secure design trade-offs.
• Embed security into build/release pipelines and identify automation opportunities.
• Develop and maintain internal security tooling and reusable frameworks to scale security.
• Lead remediation of critical vulnerabilities and coordinate with incident response.
• Mentor other security engineers and advocate secure development across teams.

Skills

Threat modelling

Security testing

CI/CD security tooling

Programming (Go/Java/Python)

Clear communication

Education

Bachelor's Degree in CS or related field

Tools

SAST

DAST

IAST

Container security tooling

ML/AI security tooling

Job description

Yahoo is seeking a Paranoids Product Security Engineer to lead application and mobile security assessments, from design to deployment, across key enterprise products. You will drive threat modeling and risk assessments, guiding engineering through secure design trade-offs.

You will partner with developers to embed security into build/release pipelines, develop internal security tooling, and coordinate with incident response on remediation.