[All remote jobs](https://jobicy.com/jobs.md)[![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg)](https://jobicy.com/company/mozilla.md)[Mozilla](https://jobicy.com/company/mozilla.md) # Senior Security GRC Engineer Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/mozilla.md)ShareRemote from[UK](https://jobicy.com/job-region/uk.md)SalaryGBP 66k–87k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished27 Oct 2026Apply before26 Nov 2026Listing views34Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Mozilla is hiring a Senior Security GRC Engineer to help operate and improve its governance, risk, and compliance framework across enterprise and product environments. The role focuses on risk assessments, risk registers, third-party risk, audit evidence collection, SOC 2 and ISO 27001 documentation, and remediation tracking. It also supports SSDLC governance, data governance, BC/DR activities, vulnerability metrics, and penetration-test coordination. The engineer will administer GRC tooling, maintain policies and standards, and automate repeatable compliance operations while working with technical and non-technical stakeholders. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position spans several interconnected GRC programs, audits, risk workflows, and security initiatives that require disciplined prioritization. Success depends on translating control requirements into actionable follow-up across many stakeholders and systems. ## Salary analysis Estimated compensation compared with the broader UK market for similar roles. Estimated job median (per year)Highly competitive£76,500UK market range (per year)£60k–£90k0£99.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. Mozilla discloses a hiring range of £66,000–£87,000 GBP for the Remote UK role. The posting does not state a cadence, so the yearly period is inferred from the professional UK hiring-range context. The estimated UK market range for a senior security GRC role is £60,000–£90,000 per year. ## Core skills Skills and capabilities most closely associated with this opportunity. [Governance Risk and Compliance](https://jobicy.com/jobs?search_keywords=Governance%20Risk%20and%20Compliance.md)[Risk Assessment](https://jobicy.com/jobs?search_keywords=Risk%20Assessment.md)[SOC 2](https://jobicy.com/jobs?search_keywords=SOC%202.md)[ISO 27001](https://jobicy.com/jobs?search_keywords=ISO%2027001.md)[NIST](https://jobicy.com/jobs?search_keywords=NIST.md)[IT Audit](https://jobicy.com/jobs?search_keywords=IT%20Audit.md)[Third-Party Risk Management](https://jobicy.com/jobs?search_keywords=Third-Party%20Risk%20Management.md)[GRC Platforms](https://jobicy.com/jobs?search_keywords=GRC%20Platforms.md)[Security Controls](https://jobicy.com/jobs?search_keywords=Security%20Controls.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[Business Continuity Planning](https://jobicy.com/jobs?search_keywords=Business%20Continuity%20Planning.md)[Python Automation](https://jobicy.com/jobs?search_keywords=Python%20Automation.md) Sample interview questionsHow would you maintain an effective risk register across multiple product and enterprise teams?I would define consistent intake criteria, risk-rating guidance, required evidence, ownership, treatment dates, and review cadences. I would use the GRC platform to automate reminders and dashboards, then hold owners accountable for updates and escalations on overdue treatments. Describe your approach to preparing for a SOC 2 or ISO 27001 audit. I begin by mapping controls to evidence owners and setting an evidence-collection timeline well before the audit. I validate evidence for completeness and operating effectiveness, track gaps in a remediation plan, prepare stakeholders for interviews, and maintain clear audit-ready documentation throughout the cycle. How would you handle a security exception request? I would document the business justification, affected assets, threat scenario, risk rating, compensating controls, accountable owner, and a firm expiration date. Approval should follow the established governance workflow, with periodic review and proactive follow-up to ensure the exception is remediated, renewed, or closed. What metrics would you use to report vulnerability-management performance to leadership? I would report vulnerability counts and trends by severity, remediation SLA compliance, overdue critical and high findings, asset coverage, exception volumes, and time to remediate. I would pair these metrics with risk context so leadership can prioritize material exposures rather than focus only on raw counts. How have you used automation to improve GRC operations? I would automate repetitive work such as evidence reminders, control-owner attestations, risk-review notifications, remediation status reporting, and data synchronization between GRC, ticketing, and asset-management tools. Automation should preserve an auditable trail while reducing manual follow-up and improving data quality. Opportunity details ## About this role. Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. ### About this team and role: The role is part of the Security Function within the broader Mozilla Infrastructure team. The Security team supports Product, Enterprise and GRC functions across the organization aligned with the mission to build a safe & secure internet. This role is responsible for defining, developing and helping implement a Governance, Risk and Compliance framework for both Enterprise and Product verticals. The ideal candidate will be responsible to deliver an integrated framework that aligns security, privacy, regulatory, and risk management initiatives across the organization. This is an ideal role for someone early in their GRC or security career who is curious, organized, and eager to take on a wide range of work. You’ll get broad exposure across risk, audit, and a growing set of security programs. ### What you’ll do: Risk Management * Perform risk assessments and process incoming risk questions and intake requests * Maintain the risk register, keeping entries accurate, current, and well documented * Track risk treatment plans and follow up with owners on progress * Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting * Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation Compliance and Audit * Coordinate evidence collection from control owners and chase outstanding requests * Help prepare control owners and stakeholders for audit interviews * Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date * Track audit gaps and findings and drive remediation to closure with control owners Security Program Support * Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards * Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners * Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps * Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items * Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up GRC Operations and Tooling * Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting * Identify opportunities to streamline processes and automate repetitive GRC work * Help maintain policies, standards, and supporting documentation ### What you’ll bring: * Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years) * Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST * Familiarity with risk assessment concepts and the risk management lifecycle * Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once * Clear written and verbal communication, and comfort working with technical and non-technical stakeholders * A collaborative, curious mindset and a genuine desire to learn and take on new challenges * Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar) * Experience supporting an audit (SOC 2, ISO 27001, or similar) * Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination * Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes * A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP) What you’ll get: * Generous performance-based bonus plans to all eligible employees—we share in our success as one team. * Rich medical, dental, and vision coverage. * Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute). * Quarterly all-company wellness days where everyone takes a pause together. * Country-specific holidays plus a day off for your birthday. * One-time home office stipend. * Annual professional development budget. * Quarterly well-being stipend. * Considerable paid parental leave. * Employee referral bonus program. * Other benefits (life/AD&D, disability, EAP, etc.—varies by country). About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientations, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at [hiringaccommodation@mozilla.com](mailto:hiringaccommodation@mozilla.com) to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: C #LI-REMOTE Req ID: R3197 Hiring Ranges: Remote UK £66,000—£87,000 GBP Show more [Apply now >](https://jobicy.com/jobs/157406-senior-security-grc-engineer.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Software Engineer, Firefox Security](https://jobicy.com/jobs/157410-senior-software-engineer-firefox-security.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Security Engineer – SecOps](https://jobicy.com/jobs/157401-senior-security-engineer-secops.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png) Socket Oct 27 New ### [Vulnerability Research Software Engineer](https://jobicy.com/jobs/157395-vulnerability-research-software-engineer.md) About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Phishing Tradecraft Researcher](https://jobicy.com/jobs/157339-senior-phishing-tradecraft-researcher.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Manager, Detection Engineering & Threat Hunting](https://jobicy.com/jobs/157334-senior-manager-detection-engineering-threat-hunting.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Researcher](https://jobicy.com/jobs/157330-principal-product-security-researcher-2.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Engineer](https://jobicy.com/jobs/157328-principal-product-security-engineer.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Airtm logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1994f28e-221.png) Airtm Oct 27 New ### [Head of security](https://jobicy.com/jobs/157316-head-of-security-2.md) About us: Airtm is a financial-infrastructure company building the future of the online-work economy. We are on a mission to empower the world’s growing number of Digital Entrepreneurs in the… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 27 New ### [Security Engineer, Agent Security](https://jobicy.com/jobs/151775-security-engineer-agent-security.md) About the TeamThe team’s mission is to accelerate the secure evolution of agentic AI systems at OpenAI. To achieve this, the team designs, implements, and continuously refines security policies, frameworks,… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 27 New ### [Technical Threat Investigator, Threat Intel Engineering](https://jobicy.com/jobs/151752-technical-threat-investigator-threat-intel-engineering.md) About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research,… [Browse all jobs](https://jobicy.com/jobs.md)