Senior Security Engineer – Vulnerability Management Lead

Job Description

Paranoids Senior Vulnerability Management Engineer | Yahoo

The Tone:
This is a contract, hybrid role at Yahoo, a company that utilizes powerful technology to connect its brands and partners with an audience of hundreds of millions. Yahoo engineers massive ad tech stacks and develops algorithms to process trillions of data points daily. This position is crucial for the information security team, “The Paranoids,” to keep users safe and establish Yahoo as one of the most secure places on the Internet.

The TL;DR
• Role: Senior Security Engineer
• Type: Contract
• Location: Hybrid – Ireland (Leinster)
• Pay: $72,600.00–$121,000.00 yearly
• Team: The Paranoids – Vulnerability & Controls Operations
• Mission: Lead the identification and mitigation of security vulnerabilities to ensure Yahoo remains a safe platform for its users.
• Tech Stack: Tenable, Nexpose, Qualys, AWS Inspector, GCP SCC, GitHub Advanced Security, Databricks, Python, Go, Kubernetes, AWS EKS, Docker, CVSS, EPSS, CISA KEV, SBOM, Agentic Defense

What You’ll Actually Do
• Vulnerability Remediation: Direct the coordination, assessment, communication, and remediation of high-severity security vulnerabilities across various environments.
• Data Analysis & Prioritization: Utilize Databricks to query, parse, and analyze massive datasets to address vulnerabilities, identify trends, and prioritize issues based on context, threat intelligence, CISA KEV, and EPSS data.
• Scanning Platform Management: Oversee technical requirements for vulnerability scanning platforms, configure scanners, and manage vendor relationships to ensure comprehensive coverage.
• AI-Driven Workflows: Design, implement, and optimize AI-driven and agentic vulnerability management workflows to automatically identify, prioritize, enrich, and track remediation of security findings.
• Supply Chain Security: Track software supply chain exposure, establish processes for collecting and assessing Software Bill of Materials (SBOM) data, and detect dependency confusion or malicious package attacks.

The Must-Haves
• Background: Bachelor’s degree in a technical discipline (e.g., Computer Science, Engineering, Information Security) or equivalent practical experience, with 7+ years in information security, specifically within vulnerability management or security engineering. This includes a strong understanding of common application, network, and OS vulnerabilities (Linux, Windows, OSX), patching, and attack patterns.
• Experience: 7+ years in information security, specifically driving critical vulnerability remediation activities and leading coordination efforts during high-pressure situations, alongside practical experience applying modern risk-based prioritization frameworks such as CVSS, Exploit Prediction Scoring System (EPSS), and CISA Known Exploited Vulnerabilities (KEV).
• Skills: Extensive experience with core vulnerability management scanners (e.g., Tenable, Nexpose, Qualys, AWS Inspector, GCP SCC, GitHub Advanced Security), strong understanding of common cloud platforms (AWS, GCP) and container technologies (Kubernetes, AWS EKS, Docker) including container scanning and Infrastructure as Code (IaC) security. Proficiency with AI tools and agentic frameworks for core vulnerability management tasks, proficiency with data analysis platforms like Databricks, and proficiency in Python or Go for automation, API interaction, and writing clean, testable code.
• Bonus: Certified Information Systems Security Professional (CISSP), CISM, or relevant cloud security certifications, experience independently leading projects to completion, intermediate to advanced capabilities with Databricks for log analysis and dashboard creation, and a background in software development life cycle (SDLC) integration, automated PR gate security reviews, patch management, and vulnerability class elimination.