Senior Security GRC Lead: AI-Driven Risk & Policy

Yahoo Holdings Inc. in; Mountain View (CA); Hybrid; USD 128,000 - 267,000; Full time

Benefits offered by this job

Healthcare

401k

Backup childcare

Education stipends

Job summary

Yahoo is seeking a Senior Security GRC Analyst (Finance) to join The Paranoids, Yahoo’s security team. The role focuses on exception management, risk assessment, and policy management across Yahoo properties, partnering with business leaders and engineers to frame risk in business terms.

You will draft risk evaluations, manage exceptions, and develop or refine security standards that guide engineering and product teams in a fast-moving environment with AI-enabled governance.

Qualifications

• 5+ years of experience in security governance, risk management, compliance, or a related information security discipline.
• Experience conducting security risk assessments and communicating actionable findings to senior leadership and technical teams.
• Strong written and verbal communication skills – ability to write executive-ready risk memos and collaborate with engineers.
• Knowledge of security frameworks and risk methodologies (NIST CSF, ISO 27001, FAIR) and cloud infrastructure, web apps, and identity systems.
• Proven experience developing or managing security policies, standards, or governance programs.
• Experience using generative AI tools (Claude, ChatGPT, Gemini, Copilot) to accelerate productivity.
• Ability to apply AI tools judiciously while considering data confidentiality and risk governance.
• Understanding of SOC 2, PCI DSS, GDPR compliance frameworks.
• Record of continuous process improvement in assessment programs, policy lifecycle, or risk tracking.

Responsibilities

• Evaluate and document known security risks for executive review with actionable treatment options.
• Manage end-to-end risk exception lifecycle from intake to reassessment across Yahoo properties.
• Conduct property- and initiative-level risk assessments against policies and frameworks.
• Draft, revise, and maintain security policies and standards for engineering and product teams.
• Collaborate with business stakeholders to socialize new or updated standards and gain cross-functional alignment.
• Translate technical security concepts for non-technical stakeholders with business context.
• Identify and implement AI-assisted workflows to streamline GRC tasks and reviews.

Skills

Security governance

Risk management

Compliance

Executive communication

NIST CSF

ISO 27001

FAIR

Policy development

Education

CRISC

CISSP

CISA

CISM

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo is seeking a Senior Security GRC Analyst (Finance) to join The Paranoids, Yahoo’s security team. The role focuses on exception management, risk assessment, and policy management across Yahoo properties, partnering with business leaders and engineers to frame risk in business terms.

You will draft risk evaluations, manage exceptions, and develop or refine security standards that guide engineering and product teams in a fast-moving environment with AI-enabled governance.