Senior Security GRC Analyst — AI-Driven Risk & Policy

Yahoo Holdings Inc.; Nashville (TN); Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Healthcare

401k

Backup childcare

Education stipends

Job summary

Yahoo is seeking a Senior Security GRC Analyst to join its information security team. The role sits at the intersection of exception management, security risk assessment, and policy/standards management, partnering with executives, engineers, and security colleagues to identify, document, and communicate risks.

The candidate will draft risk evaluations for the CISO, shape standards, and advance AI-enabled workflows, leveraging frameworks such as NIST CSF, ISO 27001, and FAIR.

Qualifications

• Experience in security governance, risk management, or compliance in modern tech environments.
• Ability to articulate actionable findings to senior leadership and technical teams.
• Familiar with security frameworks (NIST CSF, ISO 27001, FAIR) and cloud/ web infra.
• Proven track record drafting and managing security policies, standards, or governance programs.
• Experience using generative AI tools to accelerate risk analyses and documentation.
• Ability to distinguish when to apply AI vs. manual review with attention to data confidentiality.
• Knowledge of regulatory frameworks (SOC 2, PCI DSS, GDPR) and ongoing process improvements.

Responsibilities

• Evaluate and document known security risks for executive review with actionable options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment.
• Conduct risk assessments against policies, frameworks, and architectures.
• Draft and maintain security policies and standards across engineering/product teams.
• Collaborate with stakeholders to socialize standards and gather cross-functional input.
• Translate technical concepts for non-technical stakeholders while preserving business context.
• Identify AI-assisted workflows to streamline GRC tasks and policy reviews.

Skills

Security governance

Risk management

Compliance

Executive communication

Policy & standards

AI governance

AI risk evaluation

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo is seeking a Senior Security GRC Analyst to join its information security team. The role sits at the intersection of exception management, security risk assessment, and policy/standards management, partnering with executives, engineers, and security colleagues to identify, document, and communicate risks.

The candidate will draft risk evaluations for the CISO, shape standards, and advance AI-enabled workflows, leveraging frameworks such as NIST CSF, ISO 27001, and FAIR.