Senior Security GRC Engineer

• Join Mozilla’s Security team within Infrastructure as a Senior Security GRC Engineer, working fully remotely. • Help define and implement a Governance, Risk and Compliance framework across Enterprise and Product. • Align security, privacy, regulatory and risk management work across the organisation. • Gain broad exposure across risk, audit and a growing set of security programmes. • Take on a wide range of work in a role suited to someone early in their GRC or security career. • Help build a safe and secure internet at a mission-driven, non-profit-backed company.

• Bring around 2–4 years of experience in cybersecurity, GRC, IT audit or a related field. • Show working knowledge of frameworks such as SOC 2, ISO 27001 or NIST. • Understand risk assessment concepts and the risk management lifecycle. • Stay organised and follow through across many workstreams and deadlines. • Communicate clearly with technical and non-technical stakeholders. • Bring a collaborative, curious mindset and a genuine desire to learn.

• Bring hands-on experience with a GRC platform such as Vanta, Drata, OneTrust or ServiceNow GRC. • Show experience supporting a SOC 2, ISO 27001 or similar audit. • Bring exposure to vulnerability management, third-party risk, BC/DR, secure development or pen test coordination. • Use scripting or automation skills such as Python, SQL or workflow tools to improve GRC processes. • Hold or be working towards a certification such as Security+, CISA, CISM or CISSP.

• Perform risk assessments and handle incoming risk questions and intake requests. • Maintain the risk register and follow up on risk treatment plans. • Manage the exceptions and issues tracking process. • Support third-party risk activities such as vendor assessments and questionnaire reviews. • Coordinate audit evidence collection and prepare stakeholders for audit interviews. • Keep SOC 2, ISMS and Statement of Applicability documentation up to date. • Support SSDLC governance, data classification and BC/DR activities. • Track vulnerability metrics and help coordinate penetration testing engagements. • Administer the GRC platform and automate repetitive GRC work.

• Earn a generous performance-based bonus. • Get up to 26 weeks of fully paid parental leave for childbearing parents and 12 weeks for non-childbearing parents. • Receive rich medical, dental and vision coverage and generous retirement contributions with immediate vesting. • Enjoy quarterly all-company wellness days and a day off for your birthday. • Use up to $3,000 a year for professional development and a quarterly well-being stipend. • Get a one-time home office stipend and the latest hardware and software of your choice.

Mozilla Corporation is the non-profit-backed technology company behind Firefox, the privacy-minded web browser used by more than 225 million people each month. It is wholly owned by the non-profit Mozilla Foundation, so it answers to its mission rather than shareholders. Mozilla builds open-source software with over 1,000 staff in 30+ countries and thousands of volunteer contributors.