Senior Security GRC Engineer

Mozilla's Security team as a Staff Security GRC Engineer. In this role, you will be responsible for maintaining and advancing Mozilla's Information Security Management System (ISMS) and supporting our ISO 27001 and SOC 2 Type 2 compliance programs. You will work closely with cross-functional teams, including Engineering, IT, Legal, Privacy, People teams, and product leadership.

Responsibilities

• Maintenir et faire progresser le système de gestion de la sécurité de l'information (SGSI) de Mozilla, y compris la déclaration d'applicabilité, les plans de traitement des risques et le processus de révision de la direction.
• Soutenir l'exécution des audits ISO 27001 et SOC 2 Type 2, en aidant à déterminer la portée, à préparer les preuves et les artefacts narratifs, et à participer aux entretiens avec les auditeurs.
• Diriger le programme de politique de sécurité, en conduisant la création, la révision et les cycles de révision transversaux pour maintenir l'ensemble des politiques de sécurité à jour, exécutoire et prêt pour l'audit.

Requirements

• Demonstrated experience writing and revising security policies, including running cross-functional review cycles to gain organization-wide buy-in and adoption
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through meaningful involvement in audits from readiness through certification
• Ability to ramp up quickly and operate with a high degree of independence
• Experience tracking gaps and remediation plans and connecting that work to an organization's broader compliance and risk program
• Comfort operating across the full breadth of an ISMS—SoA maintenance, Management Review Meetings, and System Description authorship
• Strong written and verbal communication skills; ability to represent Mozilla credibly and confidently in front of external auditors

Preferred

• 5 years of experience in information security, GRC, or compliance-focused roles
• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus

Benefits

• This position offers a comprehensive benefits package, including health and wellness coverage, mental health support, generous time off, parental leave, financial benefits, and professional development opportunities.

The ideal candidate has hands-on experience across the full breadth of a compliance program, is comfortable building process where none yet exists, and works well with a wide range of cross-functional stakeholders

Comfort building processes where none yet exist

Excellent cross-functional collaboration skills—comfortable working with engineers, product managers, legal, and executive stakeholders, and able to translate compliance requirements into practical, actionable workflows