← All roles

Senior Security GRC Engineer

Mozilla· Infrastructure
Apply on company site
RemoteunknownPosted 2mo ago

About the role

Role within Mozilla's Security Function to define, develop, and implement a Governance, Risk and Compliance (GRC) framework for Enterprise and Product verticals, aligning security, privacy, regulatory and risk management initiatives across the organization.

Responsibilities

  • Perform risk assessments and process incoming risk questions and intake requests
  • Maintain the risk register, keeping entries accurate, current, and well documented
  • Track risk treatment plans and follow up with owners on progress
  • Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
  • Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation
  • Coordinate evidence collection from control owners and chase outstanding requests
  • Help prepare control owners and stakeholders for audit interviews
  • Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
  • Track audit gaps and findings and drive remediation to closure with control owners
  • Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC)
  • Track data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
  • Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities
  • Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
  • Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up
  • Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
  • Identify opportunities to streamline processes and automate repetitive GRC work
  • Help maintain policies, standards, and supporting documentation

Qualifications

  • Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)
  • Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST
  • Familiarity with risk assessment concepts and the risk management lifecycle
  • Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once
  • Clear written and verbal communication, and comfort working with technical and non-technical stakeholders
  • A collaborative, curious mindset and a genuine desire to learn and take on new challenges
  • Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)
  • Experience supporting an audit (SOC 2, ISO 27001, or similar)
  • Exposure to vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
  • Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes
  • A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)

Skills

Required:ISO 27001SOC 2ISMS

Benefits

  • Generous performance-based bonus plans to all eligible employees—we share in our success as one team.
  • Rich medical, dental, and vision coverage.
  • Generous retirement contributions with 100% immediate vesting.
  • Quarterly all-company wellness days.
  • Country-specific holidays plus a day off for your birthday.
  • One-time home office stipend.
  • Annual professional development budget.
  • Quarterly well-being stipend.
  • Considerable paid parental leave.
  • Employee referral bonus program.
  • Other benefits (life/AD&D, disability, EAP, etc.—varies by country)
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Mozilla

Internet for people, not profit

Mozilla is the not-for-profit behind the lightning fast Firefox browser. We put people over profit to give everyone more power online.

BrowserInternetNot-for-profitFirefox
Company profileWebsite

More open roles at Mozilla