ISMS & GRC Engineer - ISO 27001 & SOC 2 Focus

Mozilla; Greater London; On-site; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Health coverage

Mental health support

Paid parental leave

Wellbeing days

Job summary

Mozilla is seeking a Governance, Risk & Compliance (GRC) expert to maintain and advance Mozilla’s Information Security Management System (ISMS) and support ISO 27001 and SOC 2 Type 2 programs. You’ll collaborate across Engineering, IT, Legal, Privacy, People, and product leadership to translate compliance requirements into practical, auditable practices.

The role emphasizes leading the policy program, supporting internal audits, and guiding remediation and certification activities, reporting to

Qualifications

• Hands-on experience across the full breadth of a compliance program.
• Ability to build processes where none exist.
• Experience supporting ISO 27001 and SOC 2 audits.
• Translate compliance requirements into practical workflows.

Responsibilities

• Maintain and mature the ISMS, including SoA, risk treatment plans, and the MRM process.
• Support ISO 27001 and SOC 2 audit execution—from scoping to evidence and narratives.
• Lead the policy program with cross-functional review cycles for current, auditable policies.
• Partner with Engineering, IT, Legal, Privacy, People, and product leadership to implement controls.
• Advise GRC leadership on audit risk, certification readiness, and compliance strategy.

Skills

Cross-functional collab

Communication skills

Audit readiness

ISO 27001 familiarity

SOC 2 familiarity

GRC experience

Job description

Mozilla is seeking a Governance, Risk & Compliance (GRC) expert to maintain and advance Mozilla’s Information Security Management System (ISMS) and support ISO 27001 and SOC 2 Type 2 programs. You’ll collaborate across Engineering, IT, Legal, Privacy, People, and product leadership to translate compliance requirements into practical, auditable practices.

The role emphasizes leading the policy program, supporting internal audits, and guiding remediation and certification activities, reporting to