Senior Security GRC Engineer
Mozilla · Remote US
About the role
Senior Security GRC Engineer in the Security function of Mozilla's Infrastructure organisation, helping define and run an integrated governance, risk and compliance framework across the enterprise and product sides; despite the title, the posting pitches it at people early in a GRC career. The work covers risk assessments, the risk register, exceptions and third-party reviews, SOC 2 and ISMS documentation and audit evidence, SSDLC governance, data classification, BC/DR, vulnerability and penetration test follow-up, and administering the GRC platform.
Mozilla looks for two to four years in security, GRC or IT audit, knowledge of SOC 2, ISO 27001 or NIST, experience with a platform such as Vanta or Drata, and some scripting. The role is remote in the US.