Staff Security Engineer

Job Summary

To support Mozilla's Governance, Risk & Compliance (GRC) function, the full-time remote Staff Security Engineer will maintain and advance the Information Security Management System (ISMS), support ISO 27001 and SOC 2 Type 2 compliance programs, and collaborate with cross-functional teams to ensure audit readiness and certification.

Key responsibilities

• Maintain and mature the ISMS, including risk treatment plans and Management Review Meeting processes
• Support ISO 27001 and SOC 2 Type 2 audit execution, including scope determination and evidence preparation
• Lead the policy program, driving policy creation, revision, and cross-functional review cycles

Required qualifications

• 5 years of experience in information security, GRC, or compliance-focused roles
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria
• Experience writing and revising security policies with cross-functional collaboration
• Proven ability to track gaps and remediation plans within compliance and risk programs
• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus