Remote opportunity at
MozillaSenior Security GRC Engineer
Mozilla Corporation is seeking a Senior Security GRC Engineer to join its Security team's Governance, Risk, and Compliance function. Powered by a non-profit foundation, Mozilla focuses…
Career Tools
About This Role
Mozilla Corporation is seeking a Senior Security GRC Engineer to join its Security team's Governance, Risk, and Compliance function. Powered by a non-profit foundation, Mozilla focuses on technology such as the Firefox browser, artificial intelligence, social media, and security, with products used by over 225 million people globally. In this remote, full-time position, the chosen professional will maintain and expand the Information Security Management System while advancing ISO 27001 and…
Job Description
Mozilla Corporation is seeking a Senior Security GRC Engineer to join its Security team's Governance, Risk, and Compliance function. Powered by a non-profit foundation, Mozilla focuses on technology such as the Firefox browser, artificial intelligence, social media, and security, with products used by over 225 million people globally. In this remote, full-time position, the chosen professional will maintain and expand the Information Security Management System while advancing ISO 27001 and SOC 2 Type 2 compliance initiatives.
The role requires taking charge of risk treatment plans, management review meetings, and audit execution from scope definition to evidence gathering and finding resolution. The ideal candidate excels at designing compliance frameworks from scratch, writing and updating security policies, tracking remediation efforts, and collaborating across engineering, legal, privacy, and product departments. This position suits an independent professional with strong communication skills who can partner with internal and external audit resources to support expanding product lines.
Responsibilities
- Maintain and mature the Information Security Management System, statement of applicability, risk treatment plans, and management review meeting processes
- Support ISO 27001 and SOC 2 Type 2 audit execution by determining scope, assembling evidence, participating in walkthroughs, and resolving findings
- Contribute to audit narrative documentation such as the SOC 2 system description
- Monitor gaps and remediation activities resulting from readiness assessments and audits
- Lead the security policy program through creation, revision, and cross-functional review cycles
- Assist with compliance scaling as additional business units pursue readiness assessments and certifications
- Partner with internal or external resources to satisfy ISO 27001 internal audit requirements
- Collaborate with engineering, IT, legal, privacy, people teams, and product leadership to establish control ownership and practical workflows
- Advise security leadership and the GRC manager regarding audit risk, certification readiness, and compliance strategy
Requirements
- Have at least 5 years of professional experience in information security, governance, risk, and compliance, or related compliance fields
- Bring deep familiarity with ISO 27001 and the SOC 2 Trust Services Criteria through direct involvement in audits from readiness to certification
- Demonstrate hands-on capability managing an entire information security management system, including statement of applicability maintenance and management review meetings
- Possess experience writing and updating security policies while driving cross-functional adoption
- Show proven experience tracking control gaps and remediation plans aligned with a broader risk program
- Exhibit strong collaboration skills capable of translating regulatory requirements into actionable workflows for diverse stakeholders
- Operate independently with the ability to ramp up quickly and build processes from the ground up
- Display strong written and verbal communication skills to represent the organization to external auditors
Qualifications
- Hold relevant industry certifications such as CISA, CISSP, or ISO 27001 Lead Auditor/Implementer
Core Skills
Benefits
- Performance-based bonus plans for eligible employees
- Comprehensive medical, dental, and vision coverage
- Retirement contributions featuring 100% immediate vesting regardless of employee contribution
- Quarterly company-wide wellness days
- Country-specific holidays plus an extra day off for your birthday
- One-time home office stipend
- Annual professional development budget
- Quarterly well-being stipend
- Paid parental leave
- Employee referral bonus program
- Life, AD&D, disability, and employee assistance program coverage that varies by country
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting lists the location as remote.
What is the employment type?
This is a full-time position.
What is the salary for this role?
The posting does not specify the salary or hiring range.
What level of experience is required?
Candidates must have at least five years of experience in information security, GRC, or compliance-focused roles.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.