← All roles

Senior Security GRC Engineer

Mozilla· Infrastructure
Apply on company site
Remote$137k - $183kFull-timePosted 2mo ago

About the role

Senior GRC Engineer within Mozilla’s Security Function, responsible for defining and delivering an integrated Governance, Risk and Compliance framework across Enterprise and Product verticals, aligning security, privacy, regulatory, and risk management initiatives.

Responsibilities

  • Perform risk assessments and process incoming risk questions and intake requests
  • Maintain the risk register, keeping entries accurate, current, and well documented
  • Track risk treatment plans and follow up with owners on progress
  • Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
  • Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation
  • Coordinate evidence collection from control owners and chase outstanding requests
  • Help prepare control owners and stakeholders for audit interviews
  • Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
  • Track audit gaps and findings and drive remediation to closure with control owners
  • Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards
  • Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
  • Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps
  • Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
  • Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up
  • Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
  • Identify opportunities to streamline processes and automate repetitive GRC work
  • Help maintain policies, standards, and supporting documentation

Qualifications

  • Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)
  • Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST
  • Familiarity with risk assessment concepts and the risk management lifecycle
  • Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once
  • Clear written and verbal communication, and comfort working with technical and non-technical stakeholders
  • A collaborative, curious mindset and a genuine desire to learn and take on new challenges
  • Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)
  • Experience supporting an audit (SOC 2, ISO 27001, or similar)
  • Exposure to vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
  • Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes
  • A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)

Skills

Required:Risk assessmentGRC platform proficiencyAudit support
Nice to have:Scripting / automation

Benefits

  • Generous performance-based bonus plans to all eligible employees—we share in our success as one team.
  • Rich medical, dental, and vision coverage.
  • Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
  • Quarterly all-company wellness days where everyone takes a pause together.
  • Country-specific holidays plus a day off for your birthday.
  • One-time home office stipend.
  • Annual professional development budget.
  • Quarterly well-being stipend.
  • Considerable paid parental leave.
  • Employee referral bonus program.
  • Other benefits (life/AD&D, disability, EAP, etc.—varies by country).
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Mozilla

Internet for people, not profit

Mozilla is the not-for-profit behind the lightning fast Firefox browser. We put people over profit to give everyone more power online.

BrowserInternetNot-for-profitFirefox
Company profileWebsite

More open roles at Mozilla