Senior GRC Engineer: Risk, Compliance & Audit Lead

Mozilla; United States; Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

Generous bonus plans

Medical, dental, and vision coverage

Retirement contributions with 100% v

Home office stipend

Professional development budget

Parental leave

Employee referral bonus program

Life/AD&D, disability, EAP

Job summary

Mozilla seeks a Governance, Risk and Compliance (GRC) professional to define and implement an integrated risk and compliance framework across Enterprise and Product teams. You will work in the Security Function to align security, privacy, regulatory and risk initiatives, delivering an program spanning risk, audit and remediation activities.

Join a collaborative team, bringing experience in SSDLC governance, data governance, BIA, BC/DR planning, and vulnerability management.

Qualifications

• Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years).
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST.
• Familiarity with risk assessment concepts and the risk management lifecycle.
• Strong organization and follow-through with multiple workstreams and deadlines.

Responsibilities

• Define, develop and help implement a GRC framework across Enterprise and Product verticals.
• Maintain risk register and track treatment plans with owners.
• Coordinate evidence collection and readiness for audits (SOC 2, ISO 27001).
• Administer and improve GRC platform usage, workflows and reporting.
• Support data classification, data governance, BC/DR, and vulnerability management.

Skills

GRC

SOC 2

ISO 27001

NIST

Risk assessment

Documentation

Audit support

Stakeholder communication

Automation / scripting

Data governance

GRC tooling

Education

Certification in security (CISA/CISSP)

Tools

Vanta

Drata

OneTrust

ServiceNow GRC

GRC reporting

Job description

Mozilla seeks a Governance, Risk and Compliance (GRC) professional to define and implement an integrated risk and compliance framework across Enterprise and Product teams. You will work in the Security Function to align security, privacy, regulatory and risk initiatives, delivering an program spanning risk, audit and remediation activities.

Join a collaborative team, bringing experience in SSDLC governance, data governance, BIA, BC/DR planning, and vulnerability management.