Senior Security GRC & Policy Lead

Yahoo Holdings Inc. in; Omaha (NE); Hybrid; USD 160,000 - 267,000; Full time

Job summary

Yahoo Holdings Inc. is hiring a Senior Security GRC Analyst to join the Paranoids team, focusing on exception management, security risk assessment, and policy governance. You will work with business leaders, engineers, and security teams to identify, document, and communicate risks and drive informed decisions.

The role emphasizes evaluating AI-related risks, drafting executive risk memos, and embedding strong controls across Yahoo properties in a fast-moving environment.

Qualifications

• 5+ years of experience in security governance, risk management, compliance.
• Experience conducting security risk assessments and communicating findings to senior leadership and technical teams.
• Strong written and verbal communication; executive-ready risk memo writing and collaboration with engineers.
• Working knowledge of security frameworks (e.g., NIST CSF, ISO 27001, FAIR) and cloud infrastructure.
• Proven experience developing or managing security policies, standards, or governance programs.
• Experience using generative AI tools (e.g., Claude, ChatGPT, Gemini, Copilot) to accelerate productivity.
• Understanding regulatory frameworks (SOC 2, PCI DSS, GDPR) for global tech organizations.
• Track record of continuous process improvement in assessment programs or risk tracking.

Responsibilities

• Evaluate and document known security risks for executive review with actionable treatment options.
• Manage end-to-end lifecycle of risk exceptions from intake to reassessment.
• Conduct risk assessments against policies, frameworks, and architecture patterns.
• Draft, revise, and maintain security policies and standards.
• Collaborate with stakeholders to socialize new or updated standards.
• Translate technical security concepts for non-technical stakeholders with business context.
• Identify and implement AI-assisted workflows to automate GRC tasks.

Skills

Security governance

Risk assessment

Executive memo writing

Security frameworks

Policy development

AI tools usage

Regulatory compliance

Process improvement

Cross-functional collaboration

Tools

ServiceNow GRC

Archer

Jira

Job description

Yahoo Holdings Inc. is hiring a Senior Security GRC Analyst to join the Paranoids team, focusing on exception management, security risk assessment, and policy governance. You will work with business leaders, engineers, and security teams to identify, document, and communicate risks and drive informed decisions.

The role emphasizes evaluating AI-related risks, drafting executive risk memos, and embedding strong controls across Yahoo properties in a fast-moving environment.