Paranoids Senior Corporate Product Assurance Engineer

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo; known as "The Paranoids".

As a Paranoids Corporate Product Assurance Engineer, you own a review queue end to end - you take an intake request, understand the system and its trust boundaries, decide what the security requirements are, and close the review to a documented disposition inside an SLA. You will spend as much effort making reviews faster as you spend performing them, because rubrics, precedent, risk tiering, and agentic triage are how this function scales.

• Own Paranoid Security Reviews for corporate systems end to end - new third-party SaaS, vendor integrations, employee-facing tools, cloud migrations, and AI/LLM products - from intake through documented disposition, holding review SLAs rather than accumulating an open queue.
• Review MCP and agentic connections as an extension of each connected data source's security perimeter: authentication and authorization, scope and consent, token issuance and rotation, audit coverage, and what an agent may act on without human authorization.
• Assess AI and LLM integrations for prompt injection, insecure output handling, sensitive data exposure through model inputs and outputs, and data retention and residency in vendor-hosted inference.
• Run baseline configuration reviews and the annual corporate-product check-in program, surfacing products that have aged past the review cycle threshold and reconciling the SaaS inventory against actual review history.
• Evidence data-classification, encryption, logging, and access-control (MFA/Okta) gates on completed reviews against Paranoids standards and industry frameworks (NIST, OWASP, CIS).
• Write dispositions a stakeholder can act on - what was observed, what it means, whether it blocks, who owns it, and what closes it.
• Build and tune the triage and first-pass review layer: risk tiering, precedent lookup against review history, enrichment, and the guardrails that decide what an agent may close and what escalates to a person.
• Verify AI-assisted and agent-drafted review output before it becomes a disposition, so every approval is explainable and nothing closes on an unverified model claim.
• Partner across queue boundaries with Third-Party Risk, Privacy, Legal, Enterprise Identity, Cloud Security, Network Security, and the MCP Gateway team so cross-domain reviews are not silently skipped in handoff.
• Drive down per-review effort through rubrics, templates, reusable control sets, and automation, so throughput improves without proportional headcount.
• Cross-train peers so every review type has at least two capable reviewers and the function carries no single-person dependency.

• 6+ years of experience in product, application, or corporate/enterprise security, including 2+ years owning security reviews or an assurance function end to end.
• Demonstrated ownership of a review queue at volume - triage, prioritization, and closing reviews to a documented disposition under a service level, not only producing findings for someone else to resolve.
• Strong grasp of third-party and SaaS security assessment: tenant configuration, SSO and provisioning integration (SAML, OAuth 2.0, OIDC, SCIM), data flows across trust boundaries, subprocessors, and vendor data‑handling commitments.
• Working knowledge of AI/LLM application security - prompt injection, insecure output handling, sensitive data exposure through model inputs and outputs, and the OWASP Top 10 for LLM Applications.
• Practical experience reviewing agentic and tool‑use architectures (e.g., Model Context Protocol), including scope and consent, credential and token lifecycle, audit logging, and blast radius when an agent is compromised or misbehaves.
• Hands‑on identity and access review experience with Okta or a comparable IdP: MFA enforcement, provisioning and deprovisioning, service accounts and non-human identity, and least-privilege grant review.
• Understanding of enterprise and collaboration…