Paranoids Senior Vulnerability Management Engineer at Yahoo!

Job description

It takes powerful technology to connect our brands and partners with an audience of hundreds of millions of people. Whether you’re looking to write mobile app code, engineer the servers behind our massive ad tech stacks, or develop algorithms to help us process trillions of data points a day, what you do here will have a huge impact on our business—and the world. A Little About Us When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids". About Our Team The Vulnerability & Controls Operations team finds, triages, and tracks security weaknesses across cloud infrastructure, container orchestration (such as EKS), application frameworks, and core enterprise environments. We identify high-risk issues like zero-day vulnerabilities, supply chain threats, and cloud exposures using automated scanning and agentic workflows. A Lot About You We are looking for a Senior Security Engineer to serve as the lead for Vulnerability Management on a contract basis. This is a hybrid role that requires strong security engineering skills, operational leadership, and experience with automated remediation pipelines. You will be the engine behind the scenes - identifying and driving mitigation of vulnerabilities, overseeing vendor relationships, managing host-level and cloud vulnerability scanning, and utilizing Databricks and SBOM data to quantify risk at scale. You will also stand on the front lines. You must have critical vulnerability handling experience. When a major threat emerges, you will help lead the coordination and remediation efforts alongside analysts, engineers, and senior leadership. Key Responsibilities Direct the coordination, assessment, communication, and remediation of high-severity security vulnerabilities. Prioritize vulnerabilities based on specific context, distinct mitigating factors, threat intelligence feeds, CISA KEV, and Exploit Prediction Scoring System (EPSS) data. Use Databricks to query, parse, and analyze massive datasets to address vulnerabilities, identify trends, and generate insights for leadership reporting. Oversee technical requirements for vulnerability scanning platforms, configure scanners to match our changing environment, and manage vendor relationships to attain required features. Perform vulnerability scan, analysis, validation, and remediation activities across cloud, host, and application layers. Validate vulnerabilities discovered through enterprise scanners, container registry tools, IaC templates, and code analysis. Design, implement, and optimize AI-driven and agentic vulnerability management workflows (such as Agentic Defense and automated repository PR integrations) to automatically identify, prioritize, enrich, and track remediation of security findings. Utilize AI tools for core vulnerability management tasks such as parsing, summarizing, and triaging large datasets, researching emerging threats, zero-day vulnerabilities, and CVE analysis. Use AI-assisted analysis to identify systemic vulnerability trends and eliminate entire classes of vulnerabilities alongside developer platform teams. Own, maintain, and create operational process documentation and vulnerability handling runbooks regarding program execution. Work with product teams, developers, and system administrators to explain security risks, build safe defaults, and provide remediation guidance for vulnerabilities. Watch public and proprietary sources for vulnerability information, assess the impact of zero-day threats, recommend immediate action, and execute emergency response procedures. Track software supply chain exposure, establish processes for collecting and assessing Software Bill of Materials (SBOM) data across host, container, and cloud environments, and detect dependency confusion or malicious