Paranoids Senior Corporate Product Assurance Engineer at Yahoo!

Job description

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results. A Little About Us When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids". Within the Paranoids, Corporate Product Assurance is the review function for everything employees use to get their work done. Every new third-party product, SaaS integration, vendor connection, AI/LLM tool, and agentic connection entering the corporate environment comes through us before it touches Yahoo data, and we own the baseline configuration reviews and the annual check-in program for the products already in place. Intake and architecture review, MCP and agentic connection review, identity and access review - this is where a business owner who needs a tool today meets a corporate attack surface that has to stay governed. A Lot About You As a Paranoids Corporate Product Assurance Engineer, you own a review queue end to end - you take an intake request, understand the system and its trust boundaries, decide what the security requirements are, and close the review to a documented disposition inside an SLA. You will spend as much effort making reviews faster as you spend performing them, because rubrics, precedent, risk tiering, and agentic triage are how this function scales. Responsibilities Own Paranoid Security Reviews for corporate systems end to end - new third-party SaaS, vendor integrations, employee-facing tools, cloud migrations, and AI/LLM products - from intake through documented disposition, holding review SLAs rather than accumulating an open queue. Review MCP and agentic connections as an extension of each connected data source's security perimeter: authentication and authorization, scope and consent, token issuance and rotation, audit coverage, and what an agent may act on without human authorization. Assess AI and LLM integrations for prompt injection, insecure output handling, sensitive data exposure through model inputs and outputs, and data retention and residency in vendor-hosted inference. Run baseline configuration reviews and the annual corporate-product check-in program, surfacing products that have aged past the review cycle threshold and reconciling the SaaS inventory against actual review history. Evidence data-classification, encryption, logging, and access-control (MFA/Okta) gates on completed reviews against Paranoids standards and industry frameworks (NIST, OWASP, CIS). Write dispositions a stakeholder can act on - what was observed, what it means, whether it blocks, who owns it, and what closes it. Build and tune the triage and first-pass review layer: risk tiering, precedent lookup against review history, enrichment, and the guardrails that decide what an agent may close and what escalates to a person. Verify AI-assisted and agent-drafted review output before it becomes a disposition, so every approval is explainable and nothing closes on an unverified model claim. Partner across queue boundaries with Third-Party Risk, Privacy, Legal, Enterprise Identity, Cloud Security, Network Security, and the MCP Gateway team so cross-domain reviews are not silently skipped in handoff. Drive down per-review effort through rubrics, templates, reusable control sets, and automation, so throughput improves without proportional headcount. Cross-train peers so every review type has at least two capable reviewers and the function carries no single-person dependency. Basic Qualifications 6+ years of experience in product, application, or corporate/enterprise security, including 2+ years owning security reviews or an assu