ISMS & GRC Engineer (ISO 27001 / SOC 2)

Mozilla; Greater London; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Health benefits

Mental health support

Time off & holidays

Parental leave

Performance bonus

Professional development budget

Life/AD&D insurance

Wellbeing stipend

Referral bonus

Home office stipend

Job summary

Mozilla in London is seeking a senior GRC/ISMS professional to maintain and advance our information security management system. You will design and implement policy, drive audit readiness, and partner with Engineering, Legal, Privacy, and product leadership to embed compliance into everyday practices.

The role requires hands-on experience across ISO 27001, SOC 2 Type 2, and a track record of leading cross-functional policy cycles. Hybrid work and UK-based security leadership support the function.

Qualifications

• 5+ years of information security, GRC, or compliance-focused roles.
• Hands-on experience across the full breadth of a compliance program.
• Experience writing and revising security policies and leading policy cycles.

Responsibilities

• Maintain and mature the ISMS, including SoA, risk treatment plans, and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audits from scoping to evidence and auditor interviews.
• Contribute to SOC 2 System Description and audit narratives reflecting control environment.
• Track gaps and remediation from readiness assessments and audits.
• Lead policy program, driving policy creation, revision, and cross-functional reviews.
• Collaborate with Engineering, IT, Legal, Privacy, People teams, and product leadership to translate requirements into practices.
• Advise GRC manager and Security leadership on audit risk and certification readiness.

Skills

InfoSec

GRC

Policy writing

Audit readiness

Cross-functional collaboration

ISO 27001

SOC 2

ISMS

Risk management

Job description

Mozilla in London is seeking a senior GRC/ISMS professional to maintain and advance our information security management system. You will design and implement policy, drive audit readiness, and partner with Engineering, Legal, Privacy, and product leadership to embed compliance into everyday practices.

The role requires hands-on experience across ISO 27001, SOC 2 Type 2, and a track record of leading cross-functional policy cycles. Hybrid work and UK-based security leadership support the function.