Senior Security GRC Engineer

About this role

The role sits within Mozilla’s Security Function and focuses on creating and implementing a Governance, Risk and Compliance (GRC) framework for Enterprise and Product areas. It aims to align security, privacy, regulatory and risk management initiatives across the organisation. The position is suitable for someone early in their GRC or security career who is organised, curious and able to handle a wide range of tasks, with exposure to risk, audit and security programmes.

What you would do

• Perform risk assessments and process incoming risk questions and intake requests
• Maintain the risk register with accurate, up-to-date entries
• Track risk treatment plans and follow up with owners on progress
• Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up and reporting
• Support third-party risk activities such as vendor assessments, questionnaire review and remediation tracking
• Coordinate evidence collection from control owners and chase outstanding requests
• Help prepare control owners and stakeholders for audit interviews
• Keep SOC 2 system description, ISMS documentation and SoA up to date
• Track audit gaps and findings and drive remediation to closure with control owners
• Help GRC and partner teams run governance for SSDLC and related activities

What they are asking for

• Experience in cybersecurity, GRC, IT audit or related field (typically 2-4 years)
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001 or NIST
• Familiarity with risk assessment concepts and the risk management lifecycle
• Strong organisation and follow-through with ability to manage multiple workstreams
• Clear written and verbal communication with both technical and non-technical stakeholders
• Collaborative and curious mindset with willingness to learn and take on new challenges
• Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC or similar)
• Experience supporting an audit (SOC 2, ISO 27001 or similar)
• Exposure to vulnerability management, third-party risk, BC/DR, secure development practices or penetration test coordination
• Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes or a related certification in progress (e.g., Security+, CISA, CISM, CISSP)

Listing details are summarised from the source. Always confirm the role and the employer on the original posting before applying, and never pay to apply for a job.