Paranoids Endpoint Security Engineer

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

Yahoo reaches hundreds of millions of people every day, and that scale makes us a constant target for attackers of every kind, at every layer of our systems. Our job is to protect our users and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo, known as The Paranoids.

Within Cyber Resilience, our team is responsible for the security of the laptops and browsers Yahoo employees use every day, and we're growing the team to take that program further.

We're looking for someone who wants to own a security program end to end. You'll lead the rollout of a new browser security platform, running the proof of concept with our device management partners and carrying it through to full production. From there, you'll become our source of truth for endpoint security: owning the program in steady state, building the policies the platform runs on, and taking on each new milestone as our endpoint hardening roadmap grows.

You'll build relationships across teams to get security work prioritized and delivered, make pragmatic calls that balance security with how people actually get work done, and stay curious about the browser and endpoint threat landscape with a bias toward fixing root causes.

• Building and tuning the policies our browser security platform runs on, and partnering with our device management team to move a rollout from pilot devices to the full fleet
• Automating and refining how we review and score browser extension requests, using AI tools to make that process automated over time
• Reviewing and validating AI-generated policy logic, scripts, and rule changes before deployment, to make sure the output is accurate and doesn't introduce a policy bypass
• Partnering with identity, legal, and communications teams to take the next milestone on our security roadmap from design to launch
• Triaging exceptions from employees and business stakeholders, and updating the underlying policy so the same issue doesn't keep coming back as a one-off request
• Partnering with IT across the full laptop lifecycle, from secure provisioning and hardware-backed encryption to application blocking and secure data sanitization when devices or drives are retired or reused
• Reporting on fleet risk posture and program progress to security leadership
• AI-Augmented Automating:
  Develop and refine AI-assisted workflows using enterprise AI tools (e.g., Claude) to automate the review, risk-scoring, and triage of browser extension requests and endpoint policy exceptions.
• Triage incoming requests for endpoint security related exceptions and reviews
• Support team initiatives for Container Security and Cloud Security

This role is what you make of it. Our endpoint hardening program has a multi-year roadmap ahead of it, and you will have real ownership over how it evolves and where it goes next.

• Bachelor's degree in a technical discipline (i.e., Computer Science, Engineering, Information Security) or equivalent practical experience.
• Direct experience with one or more enterprise browser security or zero-trust access platforms, such as LayerX, Spin.
  
  AI, Island, Talon, Nord Layer, or similar
• 4+ years of experience in information security, specifically within endpoint security or security engineering.
• Hands-on experience hardening and managing macOS and Windows endpoints at enterprise scale, with an emphasis on security best practices and policy requirements, using MDM platforms such as Jamf or InTune, and administering browser policy through consoles like Google Workspace or Chrome Enterprise
• Solid understanding of laptop hardware and the operating systems that run on it, including hardware security features such as TPM 2.0, the Apple Secure Enclave, Secure Boot, and firmware protections, and full-disk encryption with File Vault or Bit Locker, including recovery key escrow
• Experience with application control on macOS and Windows, such as allow listing or block listing with Santa, Microsoft App Control for Business (formerly WDAC), or App Locker, including running policies in audit mode before moving to enforcement
• Working knowledge of media sanitization and device disposal best practices, such as NIST SP 800-88,…