Senior Security GRC Analyst — AI-Driven Risk & Policy

110 Yahoo Holdings Inc.; United States; Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work

Job summary

Yahoo is seeking a Senior Security GRC Analyst to join The Paranoids' Cyber Risk team. This role intersects exception management, risk assessment, and policy standards, working with leaders, engineers, and security teams to document risks and drive informed decisions.

Expect a focus on AI-assisted governance, regulatory alignment, and translating complex risk into business terms. Hybrid work options and a comprehensive benefits package are available.

Qualifications

• 5+ years of experience in security governance, risk management, compliance, or a related information security discipline within modern technology environments.
• Demonstrated experience conducting comprehensive security risk assessments and communicating actionable findings to senior leadership and technical teams.
• Strong written and verbal communication skills - proven ability to write an executive-ready risk memo, present to leaders, and collaborate effectively with software and infrastructure engineers.
• Working knowledge of security frameworks and risk methodologies (e.g., NIST CSF, ISO 27001, FAIR) and how they apply to real-world cloud infrastructure, web applications, and identity systems.
• Proven experience developing or managing security policies, standards, or exception/risk acceptance governance programs.
• Demonstrated experience using generative AI tools (e.g., Claude, ChatGPT, Gemini, Copilot) to accelerate daily productivity—including drafting documentation, structuring risk analyses, or automating repetitive research workflows.

Responsibilities

• Evaluate and document known security risks for executive review, ensuring risks are described clearly, contextualized for impact, and paired with actionable treatment options.
• Manage the end-to-end lifecycle of risk exceptions from intake and evaluation through decision, documentation, and periodic reassessment across Yahoo properties.
• Conduct property-level and initiative-level security risk assessments against Paranoids policies, industry frameworks, and modern architecture patterns.
• Draft, revise, and maintain security policies and standards that set clear, realistic expectations across engineering and product teams.
• Partner with stakeholders across the business to socialize new or updated standards, gathering input and building cross-functional alignment before publication.
• Act as a trusted liaison between business teams, engineering, and security - translating technical security concepts for non-technical stakeholders and ensuring business context informs risk decisions.

Skills

Security governance

Risk assessment

Policy and standards

Executive communication

AI risk governance

Regulatory compliance

Cloud security

Education

CRISC

CISSP

CISA

CISM

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo is seeking a Senior Security GRC Analyst to join The Paranoids' Cyber Risk team. This role intersects exception management, risk assessment, and policy standards, working with leaders, engineers, and security teams to document risks and drive informed decisions.

Expect a focus on AI-assisted governance, regulatory alignment, and translating complex risk into business terms. Hybrid work options and a comprehensive benefits package are available.