GRC Security Engineer — ISO 27001 & SOC 2 Expert

Mozilla; United States; On-site; USD 150,000 - 218,000; Full time

Benefits offered by this job

Bonus plan

Healthcare

Retirement plan

Wellness days

Holidays + birthday

Home office stipend

Professional development

Well-being stipend

Parental leave

Referral program

Other benefits

Job summary

Mozilla is seeking a Compliance & ISMS specialist within the Security team to maintain and advance the ISMS, SoA, risk treatment plans, and audit readiness for ISO 27001 and SOC 2 Type 2. You will collaborate across Engineering, Legal, Privacy, People, and product leadership to translate compliance requirements into practical, auditable controls.

The role requires hands-on experience across full compliance programs, with ability to build process where none exists and to drive policy creation,

Qualifications

• Hands-on experience across the full breadth of a compliance program.
• Ability to build process where none exists and work with cross-functional stakeholders.
• Strong written and verbal communication to articulate compliance requirements.
• Experience in audits from readiness through certification.

Responsibilities

• Maintain and mature the ISMS, SoA, risk treatment plans, and MRM cadence.
• Support ISO 27001 and SOC 2 Type 2 audit execution and evidence collection.
• Contribute to SOC 2 System Description and audit narratives reflecting control environments.
• Track gaps and remediation from readiness assessments and audits.
• Lead policy program development, reviews, and keep policies audit-ready.
• Support scalability as new products/units pursue readiness and certification.
• Assist internal audits with internal or third-party resources as needed.
• Collaborate with Engineering, IT, Legal, Privacy, People, and product leadership.
• Advise GRC manager and Security leadership on audit risk and strategy.

Skills

InfoSec

GRC

ISO 27001

SOC 2

Audit readiness

Policy writing

Cross-functional

ISMS

Certification readiness

Stakeholder mgmt

Job description

Mozilla is seeking a Compliance & ISMS specialist within the Security team to maintain and advance the ISMS, SoA, risk treatment plans, and audit readiness for ISO 27001 and SOC 2 Type 2. You will collaborate across Engineering, Legal, Privacy, People, and product leadership to translate compliance requirements into practical, auditable controls.

The role requires hands-on experience across full compliance programs, with ability to build process where none exists and to drive policy creation,