Senior Security GRC Engineer — ISO 27001 & SOC 2

Mozilla; Toronto; On-site; CAD 128,000 - 171,000; Full time

Benefits offered by this job

Performance-based bonus

Comprehensive medical, dental, vision

Retirement contributions

Wellness days

Holidays & birthday day off

Home office stipend

Professional development budget

Parental leave

Employee referral bonus

Job summary

Mozilla is seeking a seasoned GRC/Information Security professional to maintain Mozilla's ISMS and lead ISO 27001 and SOC 2 Type 2 readiness. You will work with Engineering, Legal, Privacy and product leaders to translate compliance requirements into practical, auditable practices.

The role requires hands-on experience across the full compliance program, policy development, and documentation, with the ability to drive audits from readiness through certification.

Qualifications

• 5+ years of experience in information security, GRC, or compliance-focused roles.
• Deep familiarity with ISO 27001 and SOC 2 criteria, gained through audits from readiness through certification.
• Experience maintaining ISMS components (SoA, MRM, System Description).
• Experience writing and revising security policies with cross-functional reviews.
• Experience tracking gaps/remediation and linking to risk programs.
• Excellent cross-functional collaboration with engineering, product, legal, and executive stakeholders.
• Ability to ramp up quickly and work independently; comfortable building processes where none exist.
• Strong written and verbal communication; credible in front of external auditors.
• Industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus.

Responsibilities

• Maintain and mature the ISMS, including SoA, risk treatment plans, and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audit execution—define scope, prepare evidence, participate in interviews, and resolve findings.
• Contribute to SOC 2 System Description and audit narratives to reflect the control environment.
• Track gaps and remediation from readiness assessments and audits.
• Lead the policy program: create, revise, and drive cross-functional review cycles.
• Support scaling of compliance as products/business units pursue readiness and certification.
• Assist internal audit with ISO 27001 requirements; coordinate with internal/third-party resources.
• Collaborate with Engineering, IT, Legal, Privacy, People, and product leadership to translate requirements into practical workflows.
• Advise GRC manager and Security leadership on audit risk, readiness, and program strategy.

Skills

Information security

GRC

Audit coordination

Policy management

Cross-functional

ISO 27001

SOC 2 readiness

Communication

Independent work

Risk management

Education

Bachelor's degree in information security

Tools

ISO 27001 lead auditor/implementer

CISA

CISSP

Job description

Mozilla is seeking a seasoned GRC/Information Security professional to maintain Mozilla's ISMS and lead ISO 27001 and SOC 2 Type 2 readiness. You will work with Engineering, Legal, Privacy and product leaders to translate compliance requirements into practical, auditable practices.

The role requires hands-on experience across the full compliance program, policy development, and documentation, with the ability to drive audits from readiness through certification.