Remote Global Incident Responder & Security Operations Lead

Mozilla; Town of Belgium (WI); Remote; USD 64,000 - 84,000; Full time

Benefits offered by this job

Bonus plan

Health coverage

Retirement contributions

Wellness days

Holiday + birthday off

Home office stipend

Professional development

Parental leave

Referral bonus

Life/AD&D

Job summary

Mozilla is seeking an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. You’ll be part of a 24/7 incident response team, acting as incident commander to drive the lifecycle and maintain a high-performing security posture.

You’ll bring 5+ years of global security incident experience, proficiency with SIEM/EDR/SOAR tools, and strong collaboration skills to protect users and data across Mozilla’s platforms.

Qualifications

• 5+ years in global security incident management or SOC/PSIRT/CSIRT
• Experience with SIEM systems (Splunk, ELK, BigQuery)
• Hands-on with EDR tools and endpoint telemetry for root-cause analysis
• Experience with SOAR platforms such as Tines or Splunk SOAR
• Strong communication and leadership with cross-functional stakeholders
• Background in software development/engineering operations a plus
• Cloud experience with major providers (GCP, AWS, Azure)

Responsibilities

• Identify and respond to security incidents on a global scale
• Act as incident commander through the full response lifecycle
• Design and maintain alerts, playbooks, and escalation workflows for 24/7 responsiveness
• Conduct threat hunting and maintain forward-looking defense strategies
• Research threat intel and manage related workflows
• Collaborate with stakeholders to improve preparation, identification, analysis, containment, and post mortem activities
• Participate in on-call rotation

Skills

Security incident response

SIEM experience

EDR tools

SOAR platforms

Communication & leadership

Software development experience

Cloud platforms

Education

B.S. in a technology-focused field

Tools

Splunk

ELK

Google BigQuery

SOAR tools (Tines / Splunk SOAR)

Cloud platforms (GCP, AWS, Azure)

Job description

Mozilla is seeking an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. You’ll be part of a 24/7 incident response team, acting as incident commander to drive the lifecycle and maintain a high-performing security posture.

You’ll bring 5+ years of global security incident experience, proficiency with SIEM/EDR/SOAR tools, and strong collaboration skills to protect users and data across Mozilla’s platforms.