Senior Security GRC Engineer

small; Why Mozilla?

Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we re doing this while never losing our focus on our core mission – to make the internet better for people.

The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren t beholden to any shareholders, only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms.

About this team and role:

span 400; The role is part of the Security Function within the broader Mozilla Infrastructure team. The Security team supports Product, Enterprise and GRC functions across the organization aligned with the mission to build a safe and secure internet. This role is responsible for defining, developing and helping implement a Governance, Risk and Compliance framework for both Enterprise and Product verticals. The ideal candidate will be responsible to deliver an integrated framework that aligns security, privacy, regulatory, and risk management initiatives across the organization. This is an ideal role for someone early in their GRC or security career who is curious, organized, and eager to take on a wide range of work. You’ll get broad exposure across risk, audit, and a growing set of security programs.

What you ll do:

Risk Management

400; span 400; Perform risk assessments and process incoming risk questions and intake requests
400; span 400; Maintain the risk register, keeping entries accurate, current, and well documented
400; span 400; Track risk treatment plans and follow up with owners on progress
400; span 400; Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
400; span 400; Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation

Compliance and Audit

400; span 400; Coordinate evidence collection from control owners and chase outstanding requests
400; span 400; Help prepare control owners and stakeholders for audit interviews
400; span 400; Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
400; span 400; Track audit gaps and findings and drive remediation to closure with control owners

Security Program Support

400; span 400; Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards
400; span 400; Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
400; span 400; Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps
400; span 400; Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
400; span 400; Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up

GRC Operations and Tooling

400; span 400; Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
400; span 400; Identify opportunities to streamline processes and automate repetitive GRC work
400; span 400; Help maintain policies, standards, and supporting documentation

What you ll bring:

400; span 400; Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)
400; span 400; Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST
400; span 400; Familiarity with risk assessment concepts and the risk management lifecycle
400; span 400; Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once
400; span 400; Clear written and verbal communication, and comfort working with technical and non-technical stakeholders
400; span 400; A collaborative, curious mindset and a genuine desire to learn and take on new challenges
400; span 400; Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)
400; span 400; Experience supporting an audit (SOC 2, ISO 27001, or similar)
400; span 400; Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
400; span 400; Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes
400; span 400; A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)

What you ll get: Generous performance-based bonus plans to all eligible employees, we share in our success as one team.
Rich medical, dental, and vision coverage.
Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
Quarterly all-company wellness days where everyone takes a pause together.
Country-specific holidays plus a day off for your birthday.
One-time home office stipend.
Annual professional development budget.
Quarterly well-being stipend.
Considerable paid parental leave.
Employee referral bonus program.
Other benefits (life/AD and D, disability, EAP, etc., varies by country).

About Mozilla

Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online.

Commitment to diversity, equity, inclusion, and belonging

Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation span s, gender identities, and expressions.

We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at a hiringaccommodation@mozilla.com to request accommodation.

We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose.

Group: C

# -REMOTE

Req ID: R3197

Hiring Ranges:

Remote UK

span £66,000 span span £87,000 GBP