Senior Security GRC Engineer

Mozilla; United States; Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

Generous bonus plans

Medical, dental, and vision coverage

Retirement contributions with 100% v

Home office stipend

Professional development budget

Parental leave

Employee referral bonus program

Life/AD&D, disability, EAP

Job summary

Mozilla seeks a Governance, Risk and Compliance (GRC) professional to define and implement an integrated risk and compliance framework across Enterprise and Product teams. You will work in the Security Function to align security, privacy, regulatory and risk initiatives, delivering an program spanning risk, audit and remediation activities.

Join a collaborative team, bringing experience in SSDLC governance, data governance, BIA, BC/DR planning, and vulnerability management.

Qualifications

• Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years).
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST.
• Familiarity with risk assessment concepts and the risk management lifecycle.
• Strong organization and follow-through with multiple workstreams and deadlines.

Responsibilities

• Define, develop and help implement a GRC framework across Enterprise and Product verticals.
• Maintain risk register and track treatment plans with owners.
• Coordinate evidence collection and readiness for audits (SOC 2, ISO 27001).
• Administer and improve GRC platform usage, workflows and reporting.
• Support data classification, data governance, BC/DR, and vulnerability management.

Skills

GRC

SOC 2

ISO 27001

NIST

Risk assessment

Documentation

Audit support

Stakeholder communication

Automation / scripting

Data governance

GRC tooling

Education

Certification in security (CISA/CISSP)

Tools

Vanta

Drata

OneTrust

ServiceNow GRC

GRC reporting

Job description

Why Mozilla?

The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren't beholden to any shareholders - only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms.

About this team and role:

The role is part of the Security Function within the broader Mozilla Infrastructure team. The Security team supports Product, Enterprise and GRC functions across the organization aligned with the mission to build a safe & secure internet. This role is responsible for defining, developing and helping implement a Governance, Risk and Compliance framework for both Enterprise and Product verticals. The ideal candidate will be responsible to deliver an integrated framework that aligns security, privacy, regulatory, and risk management initiatives across the organization. This is an ideal role for someone early in their GRC or security career who is curious, organized, and eager to take on a wide range of work. You’ll get broad exposure across risk, audit, and a growing set of security programs.

What you'll do:

• Perform risk assessments and process incoming risk questions and intake requests
• Maintain the risk register, keeping entries accurate, current, and well documented
• Track risk treatment plans and follow up with owners on progress
• Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
• Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation

Compliance and Audit

• Coordinate evidence collection from control owners and chase outstanding requests
• Help prepare control owners and stakeholders for audit interviews
• Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
• Track audit gaps and findings and drive remediation to closure with control owners

Security Program Support

• Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards
• Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
• Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps
• Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
• Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up

GRC Operations and Tooling

• Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
• Identify opportunities to streamline processes and automate repetitive GRC work
• Help maintain policies, standards, and supporting documentation

What you’ll bring:

• Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST
• Familiarity with risk assessment concepts and the risk management lifecycle
• Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once
• Clear written and verbal communication, and comfort working with technical and non-technical stakeholders
• A collaborative, curious mindset and a genuine desire to learn and take on new challenges
• Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)
• Experience supporting an audit (SOC 2, ISO 27001, or similar)
• Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
• Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes
• A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)

What you'll get:

• Generous performance-based bonus plans to all eligible employees—we share in our success as one team.
• Rich medical, dental, and vision coverage.
• Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
• Quarterly all-company wellness days where everyone takes a pause together.
• Country-specific holidays plus a day off for your birthday.
• One-time home office stipend.
• Annual professional development budget.
• Quarterly well-being stipend.
• Considerable paid parental leave.
• Employee referral bonus program.
• Other benefits (life/AD&D, disability, EAP, etc—varies by country).

About Mozilla

Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online.

Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission - to make the internet better for people.

Commitment to diversity, equity, inclusion, and belonging

Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions.

We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at [e-mail] to request accommodation.

We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose.