Senior Security GRC Engineer

Cyber StrategiX; United Kingdom; À distance; GBP 66 000 - 87 000; Plein temps

Avantages offerts par ce poste

Bonus plan

Medical, dental, vision

Retirement contributions

Home office stipend

Professional development budget

Parental leave

Wellness days

Employee referral program

Résumé du poste

Mozilla Corporation is hiring a Senior Security GRC Engineer to strengthen governance, risk, and compliance across enterprise and product environments. You will lead risk assessments, maintain the risk register, and coordinate third-party risk and audits for SOC 2 and ISO 27001.

The role involves administering GRC tooling, developing policies, and automating repeatable compliance tasks while collaborating with both technical and non-technical stakeholders.

Qualifications

• 2–4 years in cybersecurity or related field.
• Experience with SOC 2, ISO 27001, or NIST.
• Hands-on with a GRC platform (e.g., OneTrust, Drata).
• Strong communication with technical and non-technical stakeholders.

Responsabilités

• Perform risk assessments and maintain risk register.
• Coordinate SOC 2, ISO 27001, and NIST evidence.
• Manage third-party risk and remediation tracking.
• Administer GRC tooling and policy maintenance.
• Support SSDLC, data governance, BC/DR activities.
• Coordinate vulnerability metrics and remediation tracking.

Connaissances

GRC & Compliance

Risk Assessment

SOC 2

ISO 27001

NIST

Third-Party Risk

GRC Platforms

Security Controls

Vulnerability Mgmt

BC/DR

Python Automation

Outils

Vanta

Drata

OneTrust

ServiceNow GRC

Description du poste

Mozilla# Senior Security GRC EngineerReview the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.Apply for this job View companyRemote from: UKSalary: GBP 66k–87k / yrDepartment: CybersecurityEmployment: Full TimeExperience: SeniorPublished: 27 Oct 2026Apply before: 26 Nov 2026Listing views: 120Application actions: 10Application toolkit## Make your next move.Prepare your resume, explore your fit, and draft a cover letter for this opportunity.AI Summary## The role, at a glance.Mozilla is hiring a Senior Security GRC Engineer to help operate and improve its governance, risk, and compliance framework across enterprise and product environments. The role focuses on risk assessments, risk registers, third-party risk, audit evidence collection, SOC 2 and ISO 27001 documentation, and remediation tracking. It also supports SSDLC governance, data governance, BC/DR activities, vulnerability metrics, and penetration-test coordination. The engineer will administer GRC tooling, maintain policies and standards, and automate repeatable compliance operations while working with technical and non-technical stakeholders.## Role DNAA quick view of the complexity, pace, ownership and collaboration implied by the job description.### Job Complexity4/5EasyHard### Pace & Pressure4/5RelaxedFast-paced### Autonomy Level4/5GuidedFull ownership### Communication Load5/5IndependentCollaborative**AI insight**The position spans several interconnected GRC programs, audits, risk workflows, and security initiatives that require disciplined prioritization. Success depends on translating control requirements into actionable follow-up across many stakeholders and systems.## Salary analysisEstimated compensation compared with the broader UK market for similar roles.Estimated job median (per year)Highly competitive**£76,500**UK market range (per year)**£60k–£90k**0£99.00k**AI insight**The yearly pay period is inferred from the job context; it was not explicitly stated by the employer. Mozilla discloses a hiring range of £66,000–£87,000 GBP for the Remote UK role. The posting does not state a cadence, so the yearly period is inferred from the professional UK hiring-range context. The estimated UK market range for a senior security GRC role is £60,000–£90,000 per year.## Core skillsSkills and capabilities most closely associated with this opportunity.Governance Risk and ComplianceRisk AssessmentSOC 2ISO 27001NISTIT AuditThird-Party Risk ManagementGRC PlatformsSecurity ControlsVulnerability ManagementBusiness Continuity PlanningPython Automation**Sample interview questions**Opportunity details## About this role.**Why Mozilla?**Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people.The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms.### **About this team and role:**The role is part of the Security Function within the broader Mozilla Infrastructure team. The Security team supports Product, Enterprise and GRC functions across the organization aligned with the mission to build a safe & secure internet. This role is responsible for defining, developing and helping implement a Governance, Risk and Compliance framework for both Enterprise and Product verticals. The ideal candidate will be responsible to deliver an integrated framework that aligns security, privacy, regulatory, and risk management initiatives across the organization. This is an ideal role for someone early in their GRC or security career who is curious, organized, and eager to take on a wide range of work. You’ll get broad exposure across risk, audit, and a growing set of security programs.### **What you’ll do:****Risk Management*** Perform risk assessments and process incoming risk questions and intake requests* Maintain the risk register, keeping entries accurate, current, and well documented* Track risk treatment plans and follow up with owners on progress* Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting* Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation**Compliance and Audit*** Coordinate evidence collection from control owners and chase outstanding requests* Help prepare control owners and stakeholders for audit interviews* Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date* Track audit gaps and findings and drive remediation to closure with control owners**Security Program Support*** Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards* Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners* Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps* Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items* Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up**GRC Operations and Tooling*** Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting* Identify opportunities to streamline processes and automate repetitive GRC work* Help maintain policies, standards, and supporting documentation### **What you’ll bring:*** Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)* Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST* Familiarity with risk assessment concepts and the risk management lifecycle* Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once* Clear written and verbal communication, and comfort working with technical and non-technical stakeholders* A collaborative, curious mindset and a genuine desire to learn and take on new challenges* Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)* Experience supporting an audit (SOC 2, ISO 27001, or similar)* Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination* Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes* A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)**What you’ll get:*** Generous performance-based bonus plans to all eligible employees—we share in our success as one team.* Rich medical, dental, and vision coverage.* Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).* Quarterly all-company wellness days where everyone takes a pause together.* Country-specific holidays plus a day off for your birthday.* One-time home office stipend.* Annual professional development budget.* Quarterly well-being stipend.* Considerable paid parental leave.* Employee referral bonus program.* Other benefits (life/AD&D, disability, EAP, etc.—varies by country).**About Mozilla**Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online.**Commitment to diversity, equity, inclusion, and belonging**Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientations, gender identities, and expressions.We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at [e-mail] to request accommodation.We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose.Group: C#LI-REMOTEReq ID: R3197**Hiring Ranges:**Remote UK£66,000—£87,000 GBP