Senior Security GRC Analyst - AI-Driven Risk & Policy

ouryahoo; United States; Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work

Healthcare benefits

401k plan

Education stipends

Job summary

Yahoo is seeking a Senior Security GRC Analyst to join our team. This role sits at the intersection of exception management, security risk assessment, and policy and standards management.

You will collaborate with business leaders, engineers, and security teams to identify, assess, document, and communicate risks, guiding informed decisions for the organization. The role emphasizes AI-enabled workflows, regulatory awareness, and the ability to translate complex security concepts for

Qualifications

• 5+ years in security governance, risk management, or compliance.
• Experience communicating findings to senior leadership.
• Familiarity with NIST CSF, ISO 27001, and FAIR.
• Experience drafting security policies and exception governance.
• Experience using AI tools to accelerate documentation and risk analyses.

Responsibilities

• Evaluate and document known security risks for executive review with actionable options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment.
• Conduct risk assessments against policies, frameworks, and architecture patterns.
• Draft and maintain security policies and standards across engineering and product teams.
• Collaborate with stakeholders to socialize standards and gather cross-functional input.

Skills

Security governance

Risk management

Compliance

Communication skills

AI governance experience

Cloud security

Policy drafting

Risk assessment

NIST CSF

ISO 27001

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo is seeking a Senior Security GRC Analyst to join our team. This role sits at the intersection of exception management, security risk assessment, and policy and standards management.

You will collaborate with business leaders, engineers, and security teams to identify, assess, document, and communicate risks, guiding informed decisions for the organization. The role emphasizes AI-enabled workflows, regulatory awareness, and the ability to translate complex security concepts for