Staff Security Engineer

Mozilla is a non-profit-backed technology company focused on building a safe, open, and people-centered internet through products such as Firefox. The Staff Security Engineer will maintain and advance Mozilla's Information Security Management System and support ISO 27001 and SOC 2 Type 2 compliance programs. The role leads policy development, audit readiness, evidence gathering, remediation tracking, internal audits, and cross-functional compliance initiatives.

Responsibilities:

• Maintain and mature the ISMS, including the Statement of Applicability (SoA), risk treatment plans, and the Management Review Meeting (MRM) process and cadence
• Support ISO 27001 and SOC 2 Type 2 audit execution—helping determine scope, preparing evidence and narrative artifacts, participating in auditor interviews and walkthroughs, and resolving auditor findings
• Contribute to the SOC 2 System Description and other audit-specific narrative documentation, ensuring they accurately reflect the organization's actual control environment
• Track gaps and remediation efforts arising from readiness assessments and audits
• Lead the policy program—driving policy creation, revision, and cross-functional review cycles to keep the security policy set current, enforceable, and audit-ready
• Support compliance scaling as additional products or business units pursue readiness assessments and certification
• Support the internal audit function, partnering with internal or third-party resources as needed to meet ISO 27001's internal audit requirements
• Partner closely with Engineering, IT, Legal, Privacy, People teams, and product leadership to gather evidence, drive control ownership, and translate compliance requirements into practical, adoptable practices
• Advise the GRC manager and broader Security leadership on audit risk, certification readiness, and compliance program strategy

Requirements:

• 5 years of experience in information security, GRC, or compliance-focused roles
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, gained through meaningful involvement in audits from readiness through certification
• Comfort operating across the full breadth of an ISMS—SoA maintenance, Management Review Meetings, and System Description authorship
• Demonstrated experience writing and revising security policies, including running cross-functional review cycles to gain organization-wide buy-in and adoption
• Experience tracking gaps and remediation plans and connecting that work to an organization's broader compliance and risk program
• Excellent cross-functional collaboration skills—comfortable working with engineers, product managers, legal, and executive stakeholders, and able to translate compliance requirements into practical, actionable workflows
• Ability to ramp up quickly and operate with a high degree of independence
• Comfort building processes where none yet exist
• Strong written and verbal communication skills; ability to represent Mozilla credibly and confidently in front of external auditors
• Relevant industry certifications (e.g., CISA, CISSP, ISO 27001 Lead Auditor/Implementer) are a plus