Staff Security Engineer (GRC)

Responsibilities

• ▹Maintain and mature the ISMS, including the Statement of Applicability (SoA), risk treatment plans, and the Management Review Meeting (MRM) process
• ▹Support ISO 27001 and SOC 2 Type 2 audit execution: determining scope, preparing evidence and narrative artifacts, participating in auditor interviews
• ▹Contribute to the SOC 2 System Description and other audit-specific narrative documentation
• ▹Track gaps and remediation efforts arising from readiness assessments and audits
• ▹Lead the policy program: driving policy creation, revision, and cross-functional review cycles
• ▹Support compliance scaling as additional products or business units pursue readiness assessments and certification
• ▹Support the internal audit function, partnering with internal or third-party resources to meet ISO 27001 requirements
• ▹Partner closely with Engineering, IT, Legal, Privacy, and People teams to gather evidence and drive control ownership

Requirements

• ▹5+ years of experience in information security, GRC, or compliance-focused roles
• ▹Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through hands-on audits from readiness through certification

Soft skills

About the company

Mozilla Corporation is the non-profit-backed technology company behind pioneering products like the Firefox browser. Used by more than 225 million people every month, it is owned by the Mozilla Foundation, answering to its mission rather than to shareholders.