Senior Security GRC Engineer

Join Mozilla's Security team as a Staff Security GRC Engineer. In this role, you will be responsible for maintaining and advancing Mozilla's Information Security Management System (ISMS) and supporting our ISO 27001 and SOC 2 Type 2 compliance programs. You will work closely with cross-functional stakeholders and have the opportunity to make a significant impact on the organization's security posture.

Comfort building processes where none yet exist

Responsibilities

• Maintenir et faire progresser le système de gestion de la sécurité de l'information (SGSI) de Mozilla, y compris la déclaration d'applicabilité (SoA), les plans de traitement des risques et le processus de révision de la direction.
• Soutenir l'exécution des audits ISO 27001 et SOC 2 Type 2, en aidant à déterminer la portée, à préparer les preuves et les artefacts narratifs, à participer aux entretiens et aux visites des auditeurs.
• Diriger le programme de politique de sécurité, en conduisant la création, la révision et les cycles de révision transversaux pour maintenir l'ensemble des politiques de sécurité à jour, exécutoire et prêt pour l'audit.
• Experience tracking gaps and remediation plans and connecting that work to an organization's broader compliance and risk program
• Excellent cross-functional collaboration skills—comfortable working with engineers, product managers, legal, and executive stakeholders, and able to translate compliance requirements into practical, actionable workflows

Requirements

• Ability to ramp up quickly and operate with a high degree of independence
• Demonstrated experience writing and revising security policies, including running cross-functional review cycles to gain organization-wide buy-in and adoption
• 5 years of experience in information security, GRC, or compliance-focused roles
• Strong written and verbal communication skills; ability to represent Mozilla credibly and confidently in front of external auditors
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through meaningful involvement in audits from readiness through certification
• Comfort operating across the full breadth of an ISMS—SoA maintenance, Management Review Meetings, and System Description authorship

Preferred

• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus

Pay

GBP 66,000 - 87,000