Senior Product Security Engineer: Lead Secure Dev Practices

Yahoo Inc.; United States; Hybrid; USD 128,250 - 266,875; Full time

Benefits offered by this job

Healthcare

401k

Education stipends

Backup childcare

Job summary

Yahoo Inc. is seeking a Paranoids Senior Product Security Engineer to guide secure development for major products. You will own risk assessments, threat modeling, and embed security into build pipelines, working with developers to automate defenses.

The role requires hands-on security expertise across web and mobile applications, strong communication skills, and the ability to mentor teams toward secure coding practices. Hybrid work options are available.

Qualifications

• 5+ years of experience in application or product security.
• Deep understanding of secure architecture across distributed systems.
• Hands-on threat modeling, secure design reviews, and code assessments.
• Experience with web technologies and mobile security models.
• Proficiency in security tooling and CI/CD pipelines.

Responsibilities

• Independently lead application and mobile security assessments from design to deployment.
• Drive threat modeling and risk assessments for high-impact systems.
• Embed security into build and release pipelines and automate where possible.
• Develop and maintain internal security tooling and reusable frameworks.
• Lead remediation of critical vulnerabilities and coordinate with IR when needed.
• Mentor other engineers and promote secure development practices.

Skills

Threat modeling

Application security

SAST

DAST

IAST

CI/CD security

Backend languages

Frontend security

Communication of risk

Security tooling automation

Education

Bachelor's Degree in a relevant field

Tools

SAST tooling

DAST tooling

IAST tooling

CI/CD security tooling

Job description

Yahoo Inc. is seeking a Paranoids Senior Product Security Engineer to guide secure development for major products. You will own risk assessments, threat modeling, and embed security into build pipelines, working with developers to automate defenses.

The role requires hands-on security expertise across web and mobile applications, strong communication skills, and the ability to mentor teams toward secure coding practices. Hybrid work options are available.