Senior GRC Engineer — ISMS & ISO 27001 Lead (Remote)

Mozilla; Canada; Remote; CAD 116,000 - 171,000; Full time

Benefits offered by this job

Performance-based bonus

Medical, dental, vision coverage

Retirement contributions with 100%Vest

Home office stipend

Professional development budget

Well-being stipend

Parental leave

Employee referral bonus

Job summary

Mozilla Corporation is seeking a seasoned GRC/ISMS specialist to own and advance our information security management systems. You will drive policy, audit readiness, and cross-functional collaboration to ensure ISO 27001 and SOC 2 Type 2 compliance across product and enterprise functions.

The role requires hands-on experience with the full compliance program, building processes where none exist, and partnering with engineering, legal, privacy, and leadership to translate requirements into

Qualifications

• Experience with ISO 27001 and SOC 2 Trust Services Criteria through audits from readiness through certification.
• Ability to write and revise security policies with cross-functional stakeholder buy-in.
• Experience maintaining an ISMS, SoA, MRM processes, and audit artifacts.

Responsibilities

• Maintain and mature the ISMS, SoA, risk treatment plans, and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audit execution and evidence collection.
• Contribute to SOC 2 System Description and audit narratives.
• Track gaps, remediation, and policy program lifecycle across teams.
• Drive policy creation, revision, and cross-functional reviews for audit readiness.
• Scale compliance as products/units pursue readiness and certification.
• Support internal audits and coordinate with engineering, legal, privacy, and product leadership.
• Advise GRC leadership on risk, readiness, and strategy.

Skills

ISO 27001

SOC 2

GRC

Policy writing

Audit readiness

Cross-functional collaboration

Stakeholder management

ISMS

Job description

Mozilla Corporation is seeking a seasoned GRC/ISMS specialist to own and advance our information security management systems. You will drive policy, audit readiness, and cross-functional collaboration to ensure ISO 27001 and SOC 2 Type 2 compliance across product and enterprise functions.

The role requires hands-on experience with the full compliance program, building processes where none exist, and partnering with engineering, legal, privacy, and leadership to translate requirements into