10 days ago
Base Salary
$128k - $267k/yr
Responsibilities
- Operate and improve container image scanning and SBOM tooling in CI/CD pipelines.
- Develop container security baselines and industry-standard best practices.
- Build detections, policy-as-code guardrails, hardened base images, and self-service tooling to enforce secure container workloads.
- Secure container workloads across GCP, AWS, on-premises Linux and Windows hosts, and bare-metal environments.
- Maintain host hardening, container runtime configuration, operating-system patches, and server firmware updates.
- Develop and validate AI-assisted workflows for vulnerability triage, security policy updates, query generation, and security automation.
- Partner with platform engineering, vulnerability operations, and product teams to move security milestones into production.
- Report container fleet risk posture, remediation progress, and program metrics to security leadership.
Requirements
- Bachelor’s degree in a technical discipline such as Computer Science, Engineering, or Information Security, or equivalent practical experience.
- At least 5 years of information security experience, including at least 3 years focused on container security, cloud security engineering, or DevSecOps.
- Hands-on experience with container vulnerability scanning, SBOM tooling, CVE triage, and SPDX or CycloneDX formats.
- Experience securing GKE, Cloud Run, Artifact Registry, and container findings in Google Cloud Security Command Center.
- Experience hardening enterprise Linux, bare metal, Windows, and other distributions, and operating containerd or Docker on bare metal.
- Working knowledge of Kubernetes security controls including RBAC, namespaces, pod security, and admission control.
- AWS container experience with ECS, Fargate, EKS, ECR, and IAM.
- Strong understanding of container image hygiene, freshness, end-of-life distribution risk, signing, and provenance.
- Proficiency in Python and SQL and ability to build and maintain data pipelines using platforms such as Databricks or Spark.
- Comfort using enterprise AI tools such as Claude and Gemini for security work.
- Preferred: Google Cloud Professional Cloud Security Engineer, Certified Kubernetes Security Specialist, AWS Certified Security Specialty, or equivalent hands-on experience.
- Preferred: experience with Binary Authorization, Sigstore/cosign, OPA Gatekeeper, Kyverno, Kubernetes network policies, service mesh, mTLS, runtime security tools, bare-metal container platforms, server firmware lifecycle, CIS Benchmarks, vulnerability management, Terraform, Checkov, and AI security workflow automation.
Benefits
- Flexible hybrid work with occasional in-person events or team sessions and advance notice when attendance is needed.
- Healthcare benefits, 401k, backup childcare, education stipends, and additional benefits.
- Compensation may include discretionary annual bonus or commissions.
Tech Stack
Categories
About Yahoo
Yahoo builds consumer internet products—Mail, Finance, Sports, News, and Search—and an omnichannel advertising platform used by brands and publishers. It monetizes through ads and subscriptions while operating high-scale services that handle billions of daily requests for hundreds of millions of users. Founded in 1994 and headquartered in New York, it is a privately held company owned by Apollo Global Management.