Senior Security GRC Analyst — Hybrid & AI-Driven Risk

Yahoo; United States; Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work

Healthcare

401k

Backup childcare

Education stipends

Job summary

Yahoo seeks a Senior Security GRC Analyst to join the information security team known as the Paranoids. You will work with business leaders and engineering to identify, assess, document, and communicate security risks, shaping decisions with risk memos and policy standards.

The role emphasizes AI-assisted workflows and cross-functional collaboration within a fast-moving security landscape. Responsibilities include evaluating risks for executive review, managing risk exceptions, and socializing

Qualifications

• 5+ years of experience in security governance, risk management, compliance, or a related information security discipline.
• Demonstrated experience conducting comprehensive security risk assessments and communicating actionable findings to senior leadership and technical teams.
• Strong written and verbal communication skills - ability to write an executive-ready risk memo and collaborate with engineers.
• Working knowledge of security frameworks and risk methodologies (e.g., NIST CSF, ISO 27001, FAIR).
• Proven experience developing or managing security policies, standards, or governance programs.
• Experience using generative AI tools to accelerate productivity and automate workflows.
• Understanding of regulatory frameworks like SOC 2, PCI DSS, GDPR.
• Track record of continuous process improvement in assessment programs or policy lifecycle.

Responsibilities

• Evaluate and document known security risks for executive review with clear context and actionable options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment across Yahoo properties.
• Conduct property-level and initiative-level security risk assessments against policies and industry frameworks.
• Draft, revise, and maintain security policies and standards for engineering and product teams.
• Socialize new or updated standards with stakeholders and build cross-functional alignment.
• Translate technical security concepts for non-technical stakeholders with business context.
• Identify and implement AI-assisted workflows to streamline GRC tasks and policy reviews.

Skills

Security governance

Risk assessment

Policy management

Executive communication

AI governance knowledge

Regulatory compliance

Critical thinking

AI tools usage

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo seeks a Senior Security GRC Analyst to join the information security team known as the Paranoids. You will work with business leaders and engineering to identify, assess, document, and communicate security risks, shaping decisions with risk memos and policy standards.

The role emphasizes AI-assisted workflows and cross-functional collaboration within a fast-moving security landscape. Responsibilities include evaluating risks for executive review, managing risk exceptions, and socializing