Senior Security GRC Analyst - AI-Driven Risk & Policy

Yahoo Inc.; United States; Hybrid; USD 128,000 - 267,000; Full time

Job summary

Yahoo is seeking a Senior Security GRC Analyst to join The Paranoids Cyber Risk team in a fast-moving security landscape. You will collaborate with business leaders, engineers, and security teams to identify, assess, document, and communicate security risks, guiding risk-based decisions across Yahoo properties.

You will write risk evaluations, draft standards, and navigate exceptions with business units, leveraging AI to scale governance while maintaining confidentiality and compliance.

Qualifications

• 5+ years of experience in security governance, risk management, compliance, or a related information security discipline within modern technology environments.
• Demonstrated experience conducting comprehensive security risk assessments and communicating actionable findings to senior leadership and technical teams.

Responsibilities

• Evaluate and document known security risks for executive review, ensuring risks are described clearly, contextualized for impact, and paired with actionable treatment options.
• Manage the end-to-end lifecycle of risk exceptions from intake and evaluation through decision, documentation, and periodic reassessment across Yahoo properties.
• Conduct property-level and initiative-level security risk assessments against Paranoids policies, industry frameworks, and modern architecture patterns.
• Draft, revise, and maintain security policies and standards that set clear, realistic expectations across engineering and product teams.
• Partner with stakeholders across the business to socialize new or updated standards, gathering input and building cross-functional alignment before publication.
• Act as a trusted liaison between business teams, engineering, and security - translating technical security concepts for non-technical stakeholders and ensuring business context informs risk decisions.
• Identify and implement AI-assisted workflows and automation to eliminate manual GRC tasks, and streamline security exception and policy reviews.

Skills

Security governance

Risk management

Compliance

Executive communication

AI tools for security

Regulatory frameworks (SOC 2, PCI DSS,

Policy development

Security risk assessment

Cross-functional collaboration

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo is seeking a Senior Security GRC Analyst to join The Paranoids Cyber Risk team in a fast-moving security landscape. You will collaborate with business leaders, engineers, and security teams to identify, assess, document, and communicate security risks, guiding risk-based decisions across Yahoo properties.

You will write risk evaluations, draft standards, and navigate exceptions with business units, leveraging AI to scale governance while maintaining confidentiality and compliance.