Security Engineer, Browser & Laptop - Paranoids

Description

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

A Little About Us

Yahoo reaches hundreds of millions of people every day, and that scale makes us a constant target for attackers of every kind, at every layer of our systems. Our job is to protect our users and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo, known as The Paranoids.

Within Cyber Resilience, our team is responsible for the security of the laptops and browsers Yahoo employees use every day, and we’re growing the team to take that program further.

A Lot About You

We’re looking for a security-minded professional who wants to own an endpoint and browser security program end-to-end. You will act as our primary authority on security risk across our laptop and browser fleet. You don't need to be building deployment packages or running day-to-day MDM plumbing—our dedicated Client Engineering partners manage device enrollment, MDM infrastructure, and federation. Instead, you own the security posture that emerges from that data: defining the hardening rules, analyzing fleet data for exposure, evaluating installed software and browser extensions, and automating the exception lifecycle.

You are pragmatic, analytical, and comfortable working with structured fleet data (e.g., encryption status lists, installed extension manifests, application inventories). You don’t need to be a software engineer writing production applications from scratch, but you should be able to read scripts/code and comfortably use modern enterprise AI tools (like Claude) to inspect, query, and manipulate data to solve problems fast.

Your Day-to-Day

Browser Security Ownership: Lead the rollout and operational ownership of our browser security platform ( Spin.AI), designing policy baselines, tuning rules, and working with Client Engineering to scale from pilot to full production.

Security Data Analysis & Posture Management: Analyze endpoint and browser telemetry—such as encryption status, OS baselines, and installed software lists—to identify gaps, policy bypasses, and security exposure across the fleet.

AI-Augmented Data & Workflow Automation: Use enterprise AI tools (e.g., Claude) to inspect, parse, and manipulate structured endpoint datasets, automate the risk-scoring of browser extension requests, and eliminate repetitive security toil.

Application & Extension Governance: Maintain equal governance over both web and endpoint software surfaces: Browser Level: Review and risk-score browser extensions against manifest permissions and content scripts. Endpoint/Laptop Level: Establish and tune application control policies (e.g., Santa, AppLocker, WDAC) to govern software installed on laptops, enforce least-privilege execution, and minimize our local attack surface.

Automated Triage & Policy Exception Management: Design and deploy automated workflows to intake, evaluate, and risk-score security exceptions—shifting triage away from manual queues while refining underlying policies so common requests are resolved systematically.

Hardware & Lifecycle Security: Partner with IT and Client Engineering on hardware-backed security requirements (TPM, Apple Secure Enclave, Secure Boot, BitLocker/FileVault recovery escrow) and compliant media sanitization (NIST SP 800-88) for retired or reused assets.

Reporting: Surface actionable fleet risk posture, trend data, and compliance metrics to security leadership.

Basic Qualifications

Bachelor’s degree in Information Security, Computer Science, Engineering, or equivalent practical security experience.

3+ years of experience in Information Security, with a focus on endpoint security, security operations, or security risk analysis (distinct from pure IT help desk or general desktop support).

Proven understanding of browser security models, enterprise browser policy controls (Chrome Enterprise / Google Workspace), and browser extension risk evaluation (manifest permissions, content scripts).

Solid grounding in application-level endpoint security: managing software allowlists/blocklists and execution policies on macOS and Windows (e.g., Santa, Microsoft App Control for Business/WDAC, AppLocker).

Familiarity with enterprise browser security or zero-trust access platforms (e.g., Spin.AI, LayerX, Island, Talon, NordLayer, or similar).

Working knowledge of operating system security and hardening standards for macOS and Windows, including hardware security features (TPM 2.0, Apple Secure Enclave, Secure Boot) and full-disk encryption (FileVault, BitLocker).

Strong analytical ability with practical AI fluency: comfort reading basic code/scripts, inspecting structured data (CSV/JSON/lists), and prompting enterprise AI tools (e.g., Claude) to query datasets, analyze logs, and build automated triage workflows.

Strong communication and stakeholder skills, with the ability to balance security guardrails against how employees actually get work done.

Preferred Qualifications

Experience defining automated exception-handling or triage pipelines using scripting (Python, PowerShell) or enterprise AI tools.

Experience defining security policies that interface with enterprise identity providers (Okta, SAML) and device compliance signals.

Working knowledge of media sanitization standards, such as NIST SP 800-88.

Security certifications such as GIAC GCWN, CompTIA Security+, or relevant endpoint security credentials.

Foundational awareness of cloud security concepts (AWS, GCP) or container lifecycles.

The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies ; exercising sound judgment ; working effectively, safely and inclusively with others ; exhibiting trustworthiness and meeting expectations ; and safeguarding business operations and brand integrity.

At Yahoo, we offer flexible hybrid work options that our employees love! While most roles don’t require regular office attendance, you may occasionally be asked to attend in-person events or team sessions. You’ll always get notice to make arrangements. Your recruiter will let you know if a specific job requires regular attendance at a Yahoo office or facility. If you have any questions about how this applies to the role, just ask the recruiter!

We believe that a diverse and inclusive workplace strengthens Yahoo and deepens our relationships. When you support everyone to be their best selves, they spark discovery, innovation and creativity. Among other efforts, our 11 employee resource groups (ERGs) enhance a culture of belonging with programs, events and fellowship that help educate, support and create a workplace where all feel welcome.

The compensation for this position ranges from $111,000.00 - $231,250.00/yr and will vary depending on factors such as your location, skills and experience.The compensation package may also include incentive compensation opportunities in the form of discretionary annual bonus or commissions. Our comprehensive benefits include healthcare, a great 401k, backup childcare, education stipends and much (much) more.

Currently work for Yahoo? Please apply on our internal career site.