GRC Security Engineer: ISO 27001 & SOC 2 Compliance

Mozilla; New York (NY); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Health and wellness premiums

Mental health support

Time away and holidays

Parental leave 26 weeks / 12 weeks

401(k) / RRSP matching

Annual professional development budget

Life/AD&D and disability insurance

Remote work internet reimbursement

Office essentials budget

Job summary

Mozilla’s Governance, Risk & Compliance (GRC) within Security seeks an experienced information security professional to maintain the ISMS, oversee SoA, risk treatment plans, and the MRM process across the organization.

You will support ISO 27001 and SOC 2 Type 2 audits, develop policy programs, track remediation, and partner with Engineering, Legal, Privacy, People, and product leadership to translate compliance needs into practical workflows.

Qualifications

• Hands-on experience across the full breadth of a compliance program.
• Ability to build process where none exists and work with cross-functional teams.
• Strong written and verbal communication for audit readiness and certification.

Responsibilities

• Maintain and advance the ISMS, including SoA, risk treatment plans, and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audit execution from scope to evidence.
• Contribute to SOC 2 System Description and audit narratives reflecting control environment.
• Track gaps and remediation resulting from readiness assessments and audits.
• Lead the policy program with cross-functional review cycles to stay audit-ready.
• Support scaling of compliance as new products and units pursue certification.
• Support internal audit with internal or third-party resources as needed.
• Collaborate with Engineering, IT, Legal, Privacy, People, and product leadership.
• Advise GRC management and Security leadership on audit risk and strategy.

Skills

Policy development

Audit readiness

ISO 27001

SOC 2

Cross-functional collaboration

Written communication

Risk management

GRC awareness

Education

CISA

CISSP

ISO 27001 Lead Auditor/Implementer

Job description

Mozilla’s Governance, Risk & Compliance (GRC) within Security seeks an experienced information security professional to maintain the ISMS, oversee SoA, risk treatment plans, and the MRM process across the organization.

You will support ISO 27001 and SOC 2 Type 2 audits, develop policy programs, track remediation, and partner with Engineering, Legal, Privacy, People, and product leadership to translate compliance needs into practical workflows.