Senior Security GRC Engineer

• The role is part of the Security Function within the broader Mozilla Infrastructure team. The Security team supports Product, Enterprise and GRC functions across the organization aligned with the mission to build a safe & secure internet
• This role is responsible for defining, developing and helping implement a Governance, Risk and Compliance framework for both Enterprise and Product verticals
• You’ll get broad exposure across risk, audit, and a growing set of security programs
• Perform risk assessments and process incoming risk questions and intake requests
• Maintain the risk register, keeping entries accurate, current, and well documented
• Track risk treatment plans and follow up with owners on progress
• Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
• Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation
• Coordinate evidence collection from control owners and chase outstanding requests
• Help prepare control owners and stakeholders for audit interviews
• Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
• Track audit gaps and findings and drive remediation to closure with control owners
• Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards
• Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
• Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps
• Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
• Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up
• Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
• Identify opportunities to streamline processes and automate repetitive GRC work
• Help maintain policies, standards, and supporting documentation

Benefits

• Health and wellness: Mozilla covers medical, dental and vision plan premiums at 100% for U.S. and Canadian employees. Our offerings give you the options you need to manage your health — and your family’s — the way you want.

• Mental health: Mental health is as important as our physical health. That’s why Mozilla’s health benefits include therapy and coaching sessions to make sure our people have access to the care they need.

• Time away: With all of life’s demands, time away from work to disconnect and recharge is essential. In addition to country-specific holidays (12 in the U.S. and Canada), vacation and sick time start accruing right away (specifics vary by country). Everyone also takes a pause together on quarterly all-company wellness days, plus you get to celebrate the most personal holiday of all: your birthday.

• Parental leave: While Mozilla’s parental leave policies vary globally, our U.S. and Canadian-based employees can look forward to 26 weeks of paid leave for childbearing parents and 12 weeks of paid leave for non-childbearing parents.

• Financial: Mozilla is a private company, so our compensation isn’t tied to stock options or equity plans. Instead, we offer generous, performance-based bonus plans to all regular employees to underscore that we share in our success as one team. As for retirement savings for US and Canadian employees, Mozilla contributes a percentage of your eligible base salary each year to the 401(k) Plan/RRSP (regardless of whether you contribute or not), with 100% vesting.

• Learning and development: We’re big believers in learning by doing, and we also want to invest in your education and development beyond your role. Every employee is eligible for an annual professional development budget. Mozillians can put it toward technical or management training, certifications, conferences and more.

• Help when you need it: Life is full of surprises; that’s why it’s important to be prepared. Mozilla provides Life/AD&D and Short and Long Term Disability insurance (offerings may vary by locale) to ensure that you and your family will have a safety net in place should you ever need it.

• Plus a bit more: A few other benefits include a quarterly wellbeing stipend (to use on those things just for you), an employee referral bonus, internet reimbursement if you’re remote, and a budget for office essentials to make working remotely ergonomically comfortable.

• The ideal candidate will be responsible to deliver an integrated framework that aligns security, privacy, regulatory, and risk management initiatives across the organization

• This is an ideal role for someone early in their GRC or security career who is curious, organized, and eager to take on a wide range of work

• Familiarity with risk assessment concepts and the risk management lifecycle

• A collaborative, curious mindset and a genuine desire to learn and take on new challenges

• Experience supporting an audit (SOC 2, ISO 27001, or similar)

• Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)

• Clear written and verbal communication, and comfort working with technical and non-technical stakeholders

• Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination

• Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes

• Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once

• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST

• Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)

• A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)