Senior GRC Engineer — ISO 27001 & SOC 2 Expert

Mozilla; Greater London; Hybrid; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Bonus plans for eligible employees

Comprehensive medical/dental/vision

Retirement contributions with vesting

Professional development budget

Parental leave

Job summary

Mozilla is seeking an experienced GRC/compliance professional to maintain and mature the ISMS, support ISO 27001 and SOC 2 Type 2 audits, and lead policy programs across cross-functional teams in a remote UK setting.

You will partner with Engineering, IT, Legal, Privacy, and product leaders to translate compliance into practical workflows, drive audit readiness, and advise leadership on risk and strategy.

Qualifications

• 5 years of information security, GRC, or compliance experience.
• Familiarity with ISO 27001 and SOC 2 Trust Services Criteria through audits.
• Experience in SoA maintenance, Management Review Meetings, and System Description authorship.

Responsibilities

• Maintain and mature the ISMS, SoA, risk treatment plans and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audit execution and evidence collection.
• Contribute to SOC 2 System Description and audit narrative documentation.
• Track gaps and remediation from readiness assessments and audits.
• Lead policy program development, revision, and cross-functional reviews.
• Support compliance scaling for new products and business units.
• Assist internal audits and coordinate with external resources as needed.
• Collaborate with Engineering, IT, Legal, Privacy, People, and product leadership to translate requirements into practices.
• Advise GRC leadership on audit risk and certification readiness.

Skills

Information security

GRC

Compliance

Policy writing

Audit readiness

Cross-functional collaboration

Risk management

Excellent communication

Education

CISA

CISSP

ISO 27001 Lead Auditor/Implementer

Job description

Mozilla is seeking an experienced GRC/compliance professional to maintain and mature the ISMS, support ISO 27001 and SOC 2 Type 2 audits, and lead policy programs across cross-functional teams in a remote UK setting.

You will partner with Engineering, IT, Legal, Privacy, and product leaders to translate compliance into practical workflows, drive audit readiness, and advise leadership on risk and strategy.