Senior Security GRC Analyst — Hybrid & AI-Driven Risk

Yahoo Holdings Inc.; Reston (VA); Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work

Healthcare

401k

Education stipends

Job summary

Yahoo Holdings Inc. is seeking a Senior Security GRC Analyst to join a fast-moving team that protects Yahoo’s properties and data. You will lead risk assessments, policy development, and governance, while collaborating with leaders, engineers, and security colleagues to translate technical risk into business context.

The role emphasizes AI-enabled workflows, exception management, and policy lifecycle improvements in a global technology environment.

Qualifications

• 5+ years of experience in security governance, risk management, or compliance within modern technology environments.
• Experience conducting security risk assessments and communicating actionable findings to leadership.
• Strong written and verbal communication skills, including executive-ready risk memos.
• Knowledge of risk frameworks (NIST CSF, ISO 27001, FAIR) and cloud infrastructure/applications.
• Experience developing or managing security policies, standards, or risk governance programs.
• Experience using generative AI tools to accelerate productivity and automate workflows.
• Understanding AI data confidentiality and risk governance.
• Familiarity with SOC 2, PCI DSS, GDPR.
• Track record of continuous process improvement in risk assessment or policy lifecycle.

Responsibilities

• Evaluate and document known security risks for executive review with actionable options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment.
• Conduct property- and initiative-level security risk assessments against policies and frameworks.
• Draft, revise, and maintain security policies and standards across engineering and product teams.
• Socialize new/updated standards with stakeholders and build cross-functional alignment.
• Translate technical security concepts for non-technical stakeholders with business context.
• Identify and implement AI-assisted workflows to streamline GRC tasks and reviews.

Skills

Security governance

Risk management

Compliance

Executive communication

Security frameworks

Cloud security

AI risk governance

Policy development

Generative AI tools

Regulatory knowledge

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo Holdings Inc. is seeking a Senior Security GRC Analyst to join a fast-moving team that protects Yahoo’s properties and data. You will lead risk assessments, policy development, and governance, while collaborating with leaders, engineers, and security colleagues to translate technical risk into business context.

The role emphasizes AI-enabled workflows, exception management, and policy lifecycle improvements in a global technology environment.