Staff Security GRC Engineer
Skills
AdoptionArtifactsISO 27001ISO StandardsInformation SecurityMarketing Resource ManagementMozilla
What the job involves
The main requirements, responsibilities and hiring steps.
Requirements
- 5 years of experience in information security GRC or compliance focused roles
- Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria through audit involvement from readiness through certification
- Experience maintaining an ISMS including SoA Management Review Meetings and System Description authorship
- Experience writing revising and socializing security policies through cross-functional review cycles
- Experience tracking gaps and remediation plans within a compliance and risk program
- Excellent cross-functional collaboration skills with engineers product managers legal and executive stakeholders
- Ability to ramp up quickly operate independently and build processes where none yet exist
- Strong written and verbal communication skills with confidence in front of external auditors
Nice to have
- Independent
- Cross-functional
- Process builder
- Auditor-ready
- Collaborative
- Adaptable
Day to day
- Maintain and mature Mozilla's Information Security Management System including the Statement of Applicability risk treatment plans and Management Review Meetings.
- Support ISO 27001 and SOC 2 Type 2 audits by defining scope preparing evidence and narrative artifacts and participating in auditor interviews and walkthroughs.
- Lead policy creation revision and cross-functional review cycles while partnering with Engineering IT Legal Privacy People teams and product leadership to drive practical compliance adoption.