Paranoids Senior Container Security Engineer

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

A Little About Us

Yahoo reaches hundreds of millions of people every day, and that scale makes us a constant target for attackers of every kind, at every layer of our systems. Our job is to protect our users and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo, known as The Paranoids.

Within Cyber Resilience, our team is responsible for the security of the containers, clusters, and cloud and on-premises hosts that run Yahoo’s products, and we’re growing the team to take that program further.

A Lot About You

We’re looking for someone who wants to go deep on container security as part of a hands-on team. Working alongside the engineers who lead our container security program, you’ll help keep container workloads secure across our cloud and on‑premises environments, turn security findings into fixes that engineering teams can act on, and help the program keep maturing. You’ll build relationships across platform and product teams to get security work prioritized and delivered, make pragmatic calls that balance security with developer velocity, and stay curious about the container threat landscape with a bias toward fixing root causes.

Responsibilities

• Operating and improving container image scanning and SBOM tooling in CI/CD pipelines
• Developing container security baselines and best practices based on industry standards
• Building detections to enforce container security baselines and routing findings to the teams that own the affected workloads
• Building secure-by-default paved roads for container teams, curated hardened base images, policy-as-code guardrails, and self-service tooling – driving developer adoption, not only enforcement
• Acting as the hands-on domain specialist for securing container workloads on GCP (GKE, Cloud Run, Artifact Registry) and AWS (EKS, ECS/Fargate, ECR)
• Acting as the hands-on domain specialist for securing the on-premises Linux, Baremetal, Windows, and other distro hosts that container workloads run on, including host hardening, container runtime configuration, and keeping OS patches and server firmware current
• AI-Augmented Automation: Develop and refine AI-assisted workflows using enterprise AI tools (e.g., Claude) to automate vulnerability triage and security policy updates
• Reviewing and validating AI-generated policy changes, queries, and triage decisions before they reach production, to make sure the output is accurate and doesn’t block legitimate builds or let a real vulnerability through
• Partnering with platform engineering, vulnerability operations, and product teams to move container security milestones from design to production
• Reporting on container fleet risk posture, remediation progress, and program metrics to security leadership
• This role is what you make of it. Our container security program has a multi-year roadmap ahead of it, and you will have a real voice in how it evolves and where it goes next.

Basic Qualifications

• Bachelor’s degree in a technical discipline (i.e., Computer Science, Engineering, Information Security) or equivalent practical experience.
• 5+ years of experience in information security, with at least 3 years focused on container security, cloud security engineering, or DevSecOps.
• Hands‑on experience operating container vulnerability scanning and SBOM tooling in CI/CD, such as Grype, Syft, Trivy, Anchore, or Snyk Container, including CVE triage and working with SBOM formats like SPDX or CycloneDX
• GCP container security expertise, including hands‑on experience securing GKE clusters and Cloud Run services, scanning and governing images in Artifact Registry, and working with Security Command Center findings for container workloads
• On‑premises host expertise, including hardening enterprise Linux, Baremetal, Windows and other distributions (e.g., RHEL or its derivatives), running container runtimes such as containerd or Docker on bare metal, kernel isolation features like namespaces, cgroups, and seccomp
• Working knowledge of Kubernetes security, including RBAC, namespaces, pod security, and admission control, and how those controls differ across managed Kubernetes offerings
• AWS experience with container workloads, including ECS, Fargate, EKS, and ECR, and the IAM model that governs them
• Strong understanding of container image security fundamentals: base image hygiene, image freshness, end‑of‑life distribution risk, and image signing and provenance
• Proficiency in Python and SQL, with the ability to