Senior Security GRC Engineer

Mozilla's Security function, part of its Infrastructure team, is hiring a Senior Security GRC Engineer to help build and operate one governance, risk and compliance framework spanning enterprise and product work. The posting describes it as suited to someone relatively new to GRC. Tasks include handling risk intake and assessments, keeping the risk register and exception process current, supporting vendor reviews, gathering audit evidence and maintaining the SOC 2 system description, ISMS and Statement of Applicability, tracking SSDLC adoption, vulnerability metrics and penetration test findings, coordinating continuity planning and running the GRC platform.

Candidates need roughly two to four years in cybersecurity, GRC or audit, framework knowledge, strong organisation and audit support experience. The role is remote in the US.