Staff Security GRC Engineer @Mozilla Corporation

Overview

The role of Staff Security GRC Engineer is part of the Governance, Risk & Compliance (GRC) function within Mozilla's Security team, a non-profit-backed technology company focused on creating a better internet. This position involves maintaining and advancing Mozilla's Information Security Management System (ISMS) and supporting ISO 27001 and SOC 2 Type 2 compliance programs.

Key Responsibilities

• Maintain and mature the ISMS, including the Statement of Applicability (SoA) and risk treatment plans.
• Support ISO 27001 and SOC 2 Type 2 audit execution.
• Contribute to the SOC 2 System Description and other audit-specific documentation.
• Track gaps and remediation efforts from assessments and audits.
• Lead the policy program for creating and revising security policies.
• Support compliance scaling for new products or business units.
• Assist the internal audit function to meet ISO 27001 requirements.
• Collaborate with various teams to gather evidence and drive compliance practices.
• Advise on audit risk and compliance program strategy.

Requirements

• 5 years of experience in information security, GRC, or compliance-focused roles.
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria.
• Experience in maintaining ISMS and authoring relevant documentation.
• Proven ability to collaborate across various functions including engineering and legal.
• Strong written and verbal communication skills.
• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus.

Benefits

• Generous performance-based bonus plans.
• Comprehensive medical, dental, and vision coverage.
• Generous retirement contributions with immediate vesting.
• Quarterly wellness days.
• Country-specific holidays plus a day off for your birthday.
• Home office stipend and annual professional development budget.
• Paid parental leave and employee referral bonus program.

Location

Remote, France

How to Apply

Interested applicants should visit Mozilla's career page to apply for this position.

Deadline

No specific deadline stated.