Senior Security GRC Engineer

Join Mozilla's Security team as a Staff Security GRC Engineer. In this role, you will maintain and advance Mozilla's Information Security Management System (ISMS) and support ISO 27001 and SOC 2 Type 2 compliance programs. You will work closely with cross-functional teams, including Engineering, IT, Legal, Privacy, People teams, and product leadership. The ideal candidate has hands-on experience in compliance programs, strong communication skills, and a deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria.

Comfort building processes where none yet exist

Responsibilities

• Maintenir et faire progresser le système de gestion de la sécurité de l'information (SGSI) de Mozilla et soutenir les programmes de conformité ISO 27001 et SOC 2 Type 2.
• Participer à l'exécution des audits ISO 27001 et SOC 2 Type 2, en aidant à déterminer la portée, à préparer les preuves et les artefacts narratifs.
• Diriger le programme de politique de sécurité, en conduisant la création, la révision et les cycles de révision transversaux des politiques.
• Excellent cross-functional collaboration skills—comfortable working with engineers, product managers, legal, and executive stakeholders, and able to translate compliance requirements into practical, actionable workflows

Requirements

• The ideal candidate has hands-on experience across the full breadth of a compliance program, is comfortable building process where none yet exists, and works well with a wide range of cross-functional stakeholders
• Comfort operating across the full breadth of an ISMS—SoA maintenance, Management Review Meetings, and System Description authorship
• Strong written and verbal communication skills; ability to represent Mozilla credibly and confidently in front of external auditors
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through meaningful involvement in audits from readiness through certification
• Demonstrated experience writing and revising security policies, including running cross-functional review cycles to gain organization-wide buy-in and adoption
• Experience tracking gaps and remediation plans and connecting that work to an organization's broader compliance and risk program
• Ability to ramp up quickly and operate with a high degree of independence
• 5 years of experience in information security, GRC, or compliance-focused roles

Preferred

• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus

Pay

USD 116,000 - 183,000