Global 24/7 Incident Responder (SecOps)

Mozilla; Greater London; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Health coverage

Mental health support

Paid time off

Parental leave

401(k) plan

Professional development

Wellbeing stipend

Life/AD&D insurance

Job summary

Mozilla is seeking an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. You will be part of a flexible team handling security incidents and coordinating response across stakeholders.

The role requires 5+ years in security incident management, experience with SOC/CSIRT/PSIRT, cloud and SIEM skills, and strong communication. You will drive incident lifecycle as incident commander and contribute to playbooks, threat hunting, and post-mortems.

Qualifications

• 5+ years of security incident management at a global scale.
• Experience in SOC/PSIRT/CSIRT environments.
• Strong communication and leadership with stakeholders.
• Hands-on with cloud tech and security tooling.
• Experience in designing runbooks and playbooks.
• Ability to work on-call rotations.

Responsibilities

• Identify and respond to security incidents globally.
• Act as incident commander guiding the full response lifecycle.
• Design and maintain security alerts, playbooks, and escalation workflows.
• Conduct threat hunting and research threat intelligence.
• Collaborate with stakeholders and coordinate post-mortems.
• Participate in on-call rotation.

Skills

Incident response

Security leadership

Effective communication

Threat hunting

Team collaboration

Problem solving

Education

B.S. in Computer Science or related field

Tools

Tines

Splunk SOAR

GCP/AWS/Azure

EDR tools

SIEM (Splunk/ELK)

Endpoint telemetry

Job description

Mozilla is seeking an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. You will be part of a flexible team handling security incidents and coordinating response across stakeholders.

The role requires 5+ years in security incident management, experience with SOC/CSIRT/PSIRT, cloud and SIEM skills, and strong communication. You will drive incident lifecycle as incident commander and contribute to playbooks, threat hunting, and post-mortems.