Note: The job is a remote job and is open to candidates in USA. Yahoo is a global technology company whose information security team, known as The Paranoids, protects its users, products, and infrastructure from cyber threats. The Senior Security GRC Analyst will manage security exceptions, conduct risk assessments, maintain policies and standards, communicate risks to stakeholders and executives, and use AI-assisted workflows to improve governance processes.
Responsibilities
- Evaluate and document known security risks for executive review, ensuring risks are described clearly, contextualized for impact, and paired with actionable treatment options
- Manage the end-to-end lifecycle of risk exceptions from intake and evaluation through decision, documentation, and periodic reassessment across Yahoo properties
- Conduct property-level and initiative-level security risk assessments against Paranoids policies, industry frameworks, and modern architecture patterns
- Draft, revise, and maintain security policies and standards that set clear, realistic expectations across engineering and product teams
- Partner with stakeholders across the business to socialize new or updated standards, gathering input and building cross-functional alignment before publication
- Act as a trusted liaison between business teams, engineering, and security - translating technical security concepts for non-technical stakeholders and ensuring business context informs risk decisions
- Identify and implement AI-assisted workflows and automation to eliminate manual GRC tasks, and streamline security exception and policy reviews
Skills
- 5+ years of experience in security governance, risk management, compliance, or a related information security discipline within modern technology environments
- Demonstrated experience conducting comprehensive security risk assessments and communicating actionable findings to senior leadership and technical teams
- Strong written and verbal communication skills - proven ability to write an executive-ready risk memo, present to leaders, and collaborate effectively with software and infrastructure engineers
- Working knowledge of security frameworks and risk methodologies (e.g., NIST CSF, ISO 27001, FAIR) and how they apply to real-world cloud infrastructure, web applications, and identity systems
- Proven experience developing or managing security policies, standards, or exception/risk acceptance governance programs
- Demonstrated experience using generative AI tools (e.g., Claude, ChatGPT, Gemini, Copilot) to accelerate daily productivity—including drafting documentation, structuring risk analyses, or automating repetitive research workflows
- Strong critical evaluation skills with the ability to exercise judgment in when to apply AI tools versus manual review, paired with an understanding of AI data confidentiality and risk governance
- Understanding of regulatory and compliance frameworks applicable to global technology organizations (e.g., SOC 2, PCI DSS, GDPR)
- Track record of continuous process improvement—having established or meaningfully upgraded an assessment program, policy lifecycle, or risk tracking mechanism
- Experience working within an information security organization at a large-scale consumer technology or cloud enterprise
- Experience utilizing GRC platforms or risk workflow platforms (e.g., ServiceNow GRC, Archer, Jira) with an interest in configuring automated workflows
- Familiarity with emerging risk domains, including AI/ML security governance
- Professional security certifications such as CRISC, CISSP, CISA, or CISM
Benefits
- Flexible hybrid work options; while most roles don’t require regular office attendance, employees may occasionally be asked to attend in-person events or team sessions.
- Discretionary annual bonus or commissions
- Healthcare
- A great 401k
- Backup childcare
- Education stipends
- 11 employee resource groups (ERGs) with programs, events and fellowship that help educate, support and create a workplace where all feel welcome
Company Overview
Company H1B Sponsorship