Senior GRC & Security Policy Lead — Hybrid

Yahoo Holdings Inc.; Mountain View (CA); Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work options

Healthcare benefits

401k match

Backup childcare

Education stipends

Job summary

Yahoo Holdings Inc. is seeking a Senior Security GRC Analyst to join the Paranoids team.

You will work with business leaders, engineers, and security teams to identify, assess, document, and communicate security risks, and help the organization make informed risk-based decisions. In this hybrid role, you will manage risk exceptions, draft and maintain policies, and drive AI-enabled workflows to streamline governance.

Qualifications

• 5+ years in security governance, risk management, or related information security discipline.
• Experience conducting security risk assessments and communicating actionable findings to senior leadership and technical teams.
• Strong written and verbal communication; able to present to leaders and collaborate with engineers.
• Working knowledge of security frameworks (NIST CSF, ISO 27001, FAIR) and cloud infrastructure.
• Proven experience developing or managing security policies, standards, or governance programs.
• Experience using generative AI tools to accelerate documentation and risk analyses.
• Understanding regulatory frameworks (SOC 2, PCI DSS, GDPR).
• Proven track record improving assessment programs or risk tracking mechanisms.

Responsibilities

• Evaluate and document known security risks for executive review, with actionable treatment options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment across Yahoo properties.
• Conduct property- and initiative-level security risk assessments against Paranoids policies and industry frameworks.
• Draft, revise, and maintain security policies and standards for engineering and product teams.
• Socialize new or updated standards with stakeholders and build cross-functional alignment before publication.
• Translate technical security concepts for non-technical stakeholders and frame risk in business terms.
• Identify and implement AI-assisted workflows to streamline GRC tasks and policy reviews.

Skills

Security governance

Risk assessment

Policy management

AI governance

Executive communication

Regulatory frameworks

AI tools usage

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo Holdings Inc. is seeking a Senior Security GRC Analyst to join the Paranoids team.

You will work with business leaders, engineers, and security teams to identify, assess, document, and communicate security risks, and help the organization make informed risk-based decisions. In this hybrid role, you will manage risk exceptions, draft and maintain policies, and drive AI-enabled workflows to streamline governance.