Paranoids Endpoint Security Engineer

Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results.

A Little About Us

Yahoo reaches hundreds of millions of people every day, and that scale makes us a constant target for attackers of every kind, at every layer of our systems. Our job is to protect our users and make Yahoo one of the safest places on the Internet. We are the information security team at Yahoo, known as The Paranoids. Within Cyber Resilience, our team is responsible for the security of the laptops and browsers Yahoo employees use every day, and we're growing the team to take that program further.

About the Role

As an Endpoint Security Engineer (IC3) on the Cyber Resilience team, you will drive key initiatives that harden Yahoo's global endpoint fleet and browser ecosystem. Working independently with minimal guidance, you will lead the implementation and operational rollout of our enterprise browser security platform—partnering with IT and device management teams from proof-of-concept through production deployment across macOS and Windows devices.

You will design, deploy, and tune core security policies, balancing robust defenses with workforce productivity. Operating in a modern, AI-augmented engineering environment, you will integrate enterprise AI tools to automate extension reviews and policy triage, while applying rigorous security engineering discipline to validate AI-generated policies and scripts against potential bypasses.

What You'll Do

• Browser Security Implementation: Lead the operational rollout and continuous policy tuning of Yahoo’s enterprise browser security platform; partner with IT device management to migrate configurations from pilot groups to the broader fleet.
• Endpoint Hardening & Policy Management: Build, maintain, and audit configuration policies for macOS and Windows systems using MDM tools (Jamf, Microsoft Intune) and enterprise browser controls (Google Workspace, Chrome Enterprise).
• AI-Assisted Workflow Automation: Develop, refine, and maintain AI-assisted workflows using enterprise AI tools (e.g., Claude, Gemini) to automate the risk-scoring, intake, and triage of third-party browser extensions and policy exception requests.
• AI-Generated Policy Validation: Review, debug, and validate AI-generated scripts, detection logic, and policy rules prior to deployment, actively identifying plausible-but-wrong outputs and ensuring changes do not introduce security bypasses.
• Exception Triage & Root-Cause Engineering: Triage incoming endpoint security exception requests from cross-functional teams, analyzing trends to update baseline policies so recurring exceptions are resolved at the root level.
• Lifecycle Security Controls: Partner with IT operations across the device lifecycle—enforcing hardware-backed encryption (FileVault, BitLocker with TPM/Secure Enclave), application whitelisting (Santa, WDAC/AppLocker), and NIST SP 800-88 compliant media sanitization.
• Data Loss Prevention & Peripheral Control: Define, test, and tune DLP rules and removable media/USB control policies to mitigate unauthorized data movement without disrupting operational workflows.
• Documentation & Metrics: Maintain current technical documentation, runbooks, and exception patterns; report fleet compliance and risk posture metrics using enterprise data analytics platforms.
• Collaborative Security Initiatives: Support adjacent Cyber Resilience initiatives, collaborating with teams across Identity, Cloud Security, and Container Security.

Basic Qualifications

• 4+ years of professional experience in information security, specifically focused on endpoint security engineering, systems administration, or security operations.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent practical experience.
• Hands-on experience configuring, hardening, and deploying security policies across macOS and Windows endpoints at scale using MDM platforms (e.g., Jamf, Microsoft Intune).
• Working knowledge of OS and hardware security features, including TPM 2.0, Apple Secure Enclave, Secure Boot, FileVault, and BitLocker key escrow management.
• Experience with application execution control systems (e.g., Santa, Microsoft App Control for Business / WDAC, AppLocker) across audit and enforcement modes.
• Solid understanding of browser security architectures, extension manifest permissions (Manifest V2/V3), and policy enforcement across Chrome, Safari, Edge, and Firefox.
• Direct experience with enterprise browser security or zero-trust access platforms (e.g., LayerX, Island, Talon, Spin.AI, or equivalent).
• Demonstrated experience using enterprise AI platforms (e.g., Claude, Gemini) or AI coding tools to automate investigations, structure log analysis, or generate administration scripts.
• Demonstrated ability to critically evaluate and troubleshoot AI-generated scripts or configurations, catching logic flaws and security regressions prior to production use.
• Experience interfacing with enterprise identity providers (Okta, SAML) and defining endpoint data protection / DLP policies.
• Strong written and verbal communication skills, with experience resolving security tradeoffs alongside engineering and business partners.

Preferred Qualifications

• Industry-specific certifications in endpoint or system administration (e.g., Jamf Certified Admin, Microsoft Certified: Endpoint Administrator Associate, GIAC GCWN).
• Demonstrated experience developing prompt pipelines or automated scripts that integrate AI models into security operations workflows.
• Experience querying enterprise data platforms (e.g., Databricks, Snowflake, or SQL engines) to build security dashboards and compliance trackers.
• Familiarity with containerized environments, Kubernetes security principles, and cloud infrastructure security (AWS or GCP).
• Experience with enterprise device provisioning workflows (Apple Business Manager, Windows Autopilot) and IT Asset Disposition (ITAD) sanitization verification.

The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies; exercising sound judgment; working effectively, safely and inclusively with others; exhibiting trustworthiness and meeting expectations; and safeguarding business operations and brand integrity.

At Yahoo, we offer flexible hybrid work options that our employees love! While most roles don’t require regular office attendance, you may occasionally be asked to attend in-person events or team sessions. You’ll always get notice to make arrangements. Your recruiter will let you know if a specific job requires regular attendance at a Yahoo office or facility. If you have any questions about how this applies to the role, just ask the recruiter!

Yahoo is proud to be an equal opportunity workplace. All qualified applicants will receive consideration for employment without regard to, and will not be discriminated against based on age, race, gender, color, religion, national origin, sexual orientation, gender identity, veteran status, disability or any other protected category. Yahoo will consider for employment qualified applicants with criminal histories in a manner consistent with applicable law. Yahoo is dedicated to providing an accessible environment for all candidates during the application process and for employees during their employment. If you need accessibility assistance and/or a reasonable accommodation due to a disability, please submit a request via the Accommodation Request Form (www.yahooinc.com/careers/contact-us.html) or call +1.866.772.3182. Requests and calls received for non-disability related issues, such as following up on an application, will not receive a response.

We believe that a diverse and inclusive workplace strengthens Yahoo and deepens our relationships. When you support everyone to be their best selves, they spark discovery, innovation and creativity. Among other efforts, our 11 employee resource groups (ERGs) enhance a culture of belonging with programs, events and fellowship that help educate, support and create a workplace where all feel welcome.

The compensation for this position ranges from $111,000.00 - $231,250.00/yr and will vary depending on factors such as your location, skills and experience.The compensation package may also include incentive compensation opportunities in the form of discretionary annual bonus or commissions. Our comprehensive benefits include healthcare, a great 401k, backup childcare, education stipends and much (much) more.

Currently work for Yahoo? Please apply on our internal career site.