Senior Security GRC Analyst - Hybrid Policy & Risk

Yahoo Holdings Inc. in; Nashville (TN); Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Flexible hybrid work

Healthcare

401k plan

Education stipends

Job summary

Yahoo’s Paranoids Security team is seeking a Senior Security GRC Analyst to join the Finance program. You will evaluate risks, manage risk exceptions, and draft policies to align with frameworks like NIST CSF, ISO 27001, and PCI DSS.

You will collaborate with executives, engineers, and product teams to translate complex security concepts into actionable risk decisions and help the organization scale AI governance with clear controls and standards.

Qualifications

• 5+ years in security governance, risk management, or related discipline.
• Experience conducting security risk assessments and reporting to leadership.
• Ability to write executive-ready risk memos and collaborate with engineers.
• Knowledge of NIST CSF, ISO 27001, PCI DSS, GDPR relevance.
• Experience using AI tools for governance and risk workflows.

Responsibilities

• Evaluate and document known security risks for executive review with actionable options.
• Manage end-to-end risk exceptions lifecycle across Yahoo properties.
• Conduct risk assessments against policies, frameworks, and modern architecture.
• Draft, revise, and maintain security policies and standards.
• Partner with stakeholders to socialize standards and gain cross-functional alignment.
• Translate technical concepts for non-technical stakeholders and frame business risk.
• Identify AI-assisted workflows to streamline GRC tasks and reviews.

Skills

Security governance

Risk assessment

Policy drafting

Executive communication

AI governance

Education

CRISC certification

CISSP

CISA

CISM

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo’s Paranoids Security team is seeking a Senior Security GRC Analyst to join the Finance program. You will evaluate risks, manage risk exceptions, and draft policies to align with frameworks like NIST CSF, ISO 27001, and PCI DSS.

You will collaborate with executives, engineers, and product teams to translate complex security concepts into actionable risk decisions and help the organization scale AI governance with clear controls and standards.