Security GRC Engineer

About the company

• Mozilla Corporation is the non-profit-backed technology company behind Firefox, with 225+ million monthly users.

About the team

• Role is part of the Security Function within the Mozilla Infrastructure team, supporting Product, Enterprise and GRC functions.

Responsibilities

• Perform risk assessments and process incoming risk questions and intake requests
• Maintain the risk register and track risk treatment plans
• Manage exceptions and issues tracking process
• Support third-party risk activities (vendor assessments, questionnaire review, remediation tracking)
• Coordinate evidence collection for audits and prepare control owners for audit interviews
• Keep SOC 2 system description, ISMS documentation, and Statement of Applicability up to date
• Track audit gaps and findings and drive remediation to closure
• Support governance for Secure Software Development Lifecycle (SSDLC)
• Support data classification and data governance efforts
• Assist with business impact analysis (BIA) and BC/DR activities
• Track vulnerability management metrics and remediation status
• Coordinate penetration testing engagements
• Serve as administrator for the GRC platform
• Identify opportunities to streamline and automate GRC work

Requirements

• Experience in cybersecurity, GRC, IT audit, or related field (typically 2-4 years)
• Working knowledge of SOC 2, ISO 27001, or NIST
• Familiarity with risk assessment concepts and risk management lifecycle
• Strong organization and follow-through
• Clear written and verbal communication
• Hands-on experience with a GRC platform (Vanta, Drata, OneTrust, ServiceNow GRC)
• Experience supporting an audit (SOC 2, ISO 27001)
• Exposure to vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
• Scripting or automation skills (Python, SQL, or workflow tools)
• Relevant certification or in progress (Security+, CISA, CISM, CISSP)

Conditions

• Performance-based bonus plans
• Medical, dental, and vision coverage
• Generous retirement contributions with 100% immediate vesting
• Quarterly all-company wellness days
• Country-specific holidays plus a day off for your birthday
• One-time home office stipend
• Annual professional development budget
• Quarterly well-being stipend
• Considerable paid parental leave
• Employee referral bonus program