Note: The job is a remote job and is open to candidates in USA. Mozilla is a non-profit-backed technology company focused on building a safe, open, and accessible internet. The Staff Security GRC Engineer will maintain and advance Mozilla's Information Security Management System and support ISO 27001 and SOC 2 Type 2 compliance programs through policy and control design, audit readiness, certification, and cross-functional collaboration.
Responsibilities
- Maintain and mature the ISMS, including the Statement of Applicability (SoA), risk treatment plans, and the Management Review Meeting (MRM) process and cadence
- Support ISO 27001 and SOC 2 Type 2 audit execution—helping determine scope, preparing evidence and narrative artifacts, participating in auditor interviews and walkthroughs, and resolving auditor findings
- Contribute to the SOC 2 System Description and other audit-specific narrative documentation, ensuring they accurately reflect the organization's actual control environment
- Track gaps and remediation efforts arising from readiness assessments and audits
- Lead the policy program—driving policy creation, revision, and cross-functional review cycles to keep the security policy set current, enforceable, and audit-ready
- Support compliance scaling as additional products or business units pursue readiness assessments and certification
- Support the internal audit function, partnering with internal or third-party resources as needed to meet ISO 27001's internal audit requirements
- Partner closely with Engineering, IT, Legal, Privacy, People teams, and product leadership to gather evidence, drive control ownership, and translate compliance requirements into practical, adoptable practices
- Advise the GRC manager and broader Security leadership on audit risk, certification readiness, and compliance program strategy
Skills
- 5 years of experience in information security, GRC, or compliance-focused roles
- Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through meaningful involvement in audits from readiness through certification
- Comfort operating across the full breadth of an ISMS—SoA maintenance, Management Review Meetings, and System Description authorship
- Demonstrated experience writing and revising security policies, including running cross-functional review cycles to gain organization-wide buy-in and adoption
- Experience tracking gaps and remediation plans and connecting that work to an organization's broader compliance and risk program
- Excellent cross-functional collaboration skills—comfortable working with engineers, product managers, legal, and executive stakeholders, and able to translate compliance requirements into practical, actionable workflows
- Ability to ramp up quickly and operate with a high degree of independence
- Comfort building processes where none yet exist
- Strong written and verbal communication skills; ability to represent Mozilla credibly and confidently in front of external auditors
- Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus
Benefits
- Generous performance-based bonus plans to all eligible employees—we share in our success as one team.
- Rich medical, dental, and vision coverage.
- Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
- Quarterly all-company wellness days where everyone takes a pause together.
- Country-specific holidays plus a day off for your birthday.
- One-time home office stipend.
- Annual professional development budget.
- Quarterly well-being stipend.
- Considerable paid parental leave.
- Employee referral bonus program.
- Other benefits (life/AD&D, disability, EAP, etc.—varies by country).
Company Overview
Company H1B Sponsorship