Senior Security GRC Engineer - Remote UK

Devconnectplatform; United Kingdom; Remote; GBP 66,000 - 87,000; Full time

Benefits offered by this job

Performance-based bonus

Healthcare and vision coverage

Retirement contributions

Home office stipend

Professional development budget

Well-being stipend

Parental leave

Employee referral bonus

Job summary

Mozilla seeks a Senior Security GRC Engineer to define and implement governance, risk, and compliance across Enterprise and Product divisions. You will manage risk assessments, control ownership, and audit readiness while aligning security, privacy, and regulatory requirements.

Ideal candidates have 2–4 years in GRC or security, are hands-on with GRC tooling, and can collaborate with diverse teams to improve governance and risk management processes. This role is remote UK.

Qualifications

• 2–4 years in cybersecurity, GRC, or IT audit.
• Familiarity with risk management, control owners, and audit processes.
• Experience coordinating SOC 2 or ISO 27001/audit activities.

Responsibilities

• Perform risk assessments and manage risk intake requests.
• Maintain risk register with up-to-date entries and documentation.
• Track risk treatment plans and follow up with owners.
• Coordinate evidence collection for audits and support interviews.
• Maintain SOC 2 SoA, ISMS docs, and control descriptions.
• Track audit gaps and drive remediation with owners.
• Help run SSDLC governance and evidence gathering.
• Support data classification and governance documentation.

Skills

GRC/IT audit

SOC 2/ISO 27001/NIST knowledge

Risk assessment lifecycle

Communication

Python/SQL scripting

Education

Bachelor's degree in Cybersecurity or related field

Tools

GRC platform (Vanta/Drata/OneTrust/ServiceNow GRC)

Job description

Mozilla seeks a Senior Security GRC Engineer to define and implement governance, risk, and compliance across Enterprise and Product divisions. You will manage risk assessments, control ownership, and audit readiness while aligning security, privacy, and regulatory requirements.

Ideal candidates have 2–4 years in GRC or security, are hands-on with GRC tooling, and can collaborate with diverse teams to improve governance and risk management processes. This role is remote UK.