> Markdown version of [/jobs/ext/3461354-paranoids-senior-security-grc-analyst](https://www.wearedevelopers.com/jobs/ext/3461354-paranoids-senior-security-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Paranoids Senior Security GRC Analyst - **Company:** Yahoo - **Location:** Nashville, TN, United States - **Experience:** Expert - **Salary:** $128,250.0 - $266,875.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, JIRA, Cloud Computing, Cyber Security, Data Auditing, PCI Data Security Standards, Technical Data Management Systems, Web Applications, RSA Archer Platform, GPT, Servicenow - **Published:** September 7, 2026 - **Apply:** https://www.disabledperson.com/jobs/74950127-paranoids-senior-security-grc-analyst ## About the Role * 5+ years of experience in security governance, risk management, compliance, or a related information security discipline within modern technology environments. * Demonstrated experience conducting comprehensive security risk assessments and communicating actionable findings to senior leadership and technical teams. * Strong written and verbal communication skills - proven ability to write an executive-ready risk memo, present to leaders, and collaborate effectively with software and infrastructure engineers. * Working knowledge of security frameworks and risk methodologies (e.g., NIST CSF, ISO 27001, FAIR) and how they apply to real-world cloud infrastructure, web applications, and identity systems. * Proven experience developing or managing security policies, standards, or exception/risk acceptance governance programs. * Demonstrated experience using generative AI tools (e.g., Claude, ChatGPT, Gemini, Copilot) to accelerate daily productivity-including drafting documentation, structuring risk analyses, or automating repetitive research workflows. * Strong critical evaluation skills with the ability to exercise judgment in when to apply AI tools versus manual review, paired with an understanding of AI data confidentiality and risk governance. * Understanding of regulatory and compliance frameworks applicable to global technology organizations (e.g., SOC 2, PCI DSS, GDPR). * Track record of continuous process improvement-having established or meaningfully upgraded an assessment program, policy lifecycle, or risk tracking mechanism., * Experience working within an information security organization at a large-scale consumer technology or cloud enterprise. * Experience utilizing GRC platforms or risk workflow platforms (e.g., ServiceNow GRC, Archer, Jira) with an interest in configuring automated workflows. * Familiarity with emerging risk domains, including AI/ML security governance * Professional security certifications such as CRISC, CISSP, CISA, or CISM. The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies ; exercising sound judgment ; working effectively, safely and inclusively with others ; exhibiting trustworthiness and meeting expectations ; and safeguarding business operations and brand integrity. ## Description Yahoo serves as a trusted guide for hundreds of millions of people globally, helping them achieve their goals online through our portfolio of iconic products. For advertisers, Yahoo Advertising offers omnichannel solutions and powerful data to engage with our brands and deliver results., Within the Paranoids, the Cyber Risk team exists to guide Yahoo to make reasonable, compliant, cyber risk-conscious decisions. We position security as a business advantage - surfacing actionable cyber risks, facilitating executive risk decisions, and ensuring that security and compliance are aligned with company goals., We are looking for a Senior Security GRC Analyst to join the team. This role sits at the intersection of three critical GRC functions: exception management, security risk assessment, and policy and standards management. You will work directly with business leaders, engineers, and Paranoids security teams to identify, assess, document, and communicate security risks - and then help the organization make informed decisions about them. Some days that means writing a risk evaluation memo that goes to the CISO. Other days it means assessing a property's security posture against Paranoids policy, drafting a new standard, or working through the nuances of an exception request with a business unit that's navigating a hard tradeoff. We operate in a modern, fast-moving security landscape. We view AI as a force multiplier that allows us to scale governance, synthesize complex technical data faster, and deliver higher-impact risk insights. The work requires that you understand enough about technology to ask the right questions, exercise sound judgment when evaluating AI-generated outputs, and understand enough about the business to frame risk in terms that drive good decisions. Responsibilities * Evaluate and document known security risks for executive review, ensuring risks are described clearly, contextualized for impact, and paired with actionable treatment options. * Manage the end-to-end lifecycle of risk exceptions from intake and evaluation through decision, documentation, and periodic reassessment across Yahoo properties. * Conduct property-level and initiative-level security risk assessments against Paranoids policies, industry frameworks, and modern architecture patterns. * Draft, revise, and maintain security policies and standards that set clear, realistic expectations across engineering and product teams. * Partner with stakeholders across the business to socialize new or updated standards, gathering input and building cross-functional alignment before publication. * Act as a trusted liaison between business teams, engineering, and security - translating technical security concepts for non-technical stakeholders and ensuring business context informs risk decisions. * Identify and implement AI-assisted workflows and automation to eliminate manual GRC tasks, and streamline security exception and policy reviews ## Related Videos - [How to Stop Your Agents From Going Rogue - Arnav Gupta](https://www.wearedevelopers.com/videos/2152-how-to-stop-your-agents-from-going-rogue-arnav-gupta) - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [GitOps for the people](https://www.wearedevelopers.com/videos/461-gitops-for-the-people) - [Livecoding with AI](https://www.wearedevelopers.com/videos/1201-livecoding-with-ai) - [AI in Production: applied AI & enterprise use cases](https://www.wearedevelopers.com/videos/100130-ai-in-production-applied-ai-enterprise-use-cases) - [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)