Staff Security Engineer

Mozilla

Mozilla Staff Security Engineer maintaining ISMS and supporting ISO 27001 and SOC 2 compliance programs. Leading audits, policies, remediation, and cross-functional security governance.

Posted 8/11/2026full-timeRemote • 🇩🇪 GermanyLead💰 €81,000 - €108,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in maintaining and maturing Information Security Management Systems (ISMS) and supporting ISO 27001 and SOC 2 compliance efforts. Proficient in policy creation, risk treatment planning, and collaborating with cross-functional teams to translate compliance requirements into actionable practices.

Highest-signal resume keywords

ISO 27001 ComplianceSOC 2 Audit ExecutionInformation Security Management System (ISMS)Security Policy DevelopmentRisk Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk Treatment PlansStatement of Applicability (SoA)Management Review Meetings (MRM)System Description AuthorshipCompliance TrackingAudit Evidence PreparationControl OwnershipRemediation Planning

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationCross-Functional CollaborationIndependent Operation

Certifications & Qualifications

CISACISSPISO 27001 Lead AuditorISO 27001 Implementer

Industry Keywords

Governance, Risk, and Compliance (GRC)Compliance ScalingAudit RiskCertification ReadinessTrust Services Criteria

About the role

Key responsibilities & impact

Maintain and mature the ISMS, including the Statement of Applicability (SoA), risk treatment plans, and the Management Review Meeting (MRM) process and cadence.
Support ISO 27001 and SOC 2 Type 2 audit execution, including scope determination, evidence and narrative preparation, auditor interviews and walkthroughs, and resolution of auditor findings.
Contribute to the SOC 2 System Description and other audit-specific narrative documentation.
Track gaps and remediation efforts from readiness assessments and audits.
Lead the security policy program, including policy creation, revision, and cross-functional review cycles.
Support compliance scaling as additional products or business units pursue readiness assessments and certification.
Support the internal audit function with internal or third-party resources.
Partner with Engineering, IT, Legal, Privacy, People teams, and product leadership to gather evidence, drive control ownership, and translate compliance requirements into practical practices.
Advise the GRC manager and Security leadership on audit risk, certification readiness, and compliance program strategy.

Requirements

What you’ll need

5 years of experience in information security, GRC, or compliance-focused roles.
Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria through audits from readiness through certification.
Experience across the full breadth of an ISMS, including SoA maintenance, Management Review Meetings, and System Description authorship.
Demonstrated experience writing and revising security policies and running cross-functional review cycles.
Experience tracking gaps and remediation plans within a broader compliance and risk program.
Ability to work with engineers, product managers, legal, and executive stakeholders and translate compliance requirements into practical workflows.
Ability to ramp up quickly and operate independently.
Comfort building processes where none yet exist.
Strong written and verbal communication skills and ability to represent Mozilla before external auditors.
Relevant industry certifications such as CISA, CISSP, or ISO 27001 Lead Auditor/Implementer are a plus.

Benefits

Comp & perks

Generous performance-based bonus plans to all eligible employees—we share in our success as one team.
Rich medical, dental, and vision coverage.
Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
Quarterly all-company wellness days where everyone takes a pause together.
Country-specific holidays plus a day off for your birthday.
One-time home office stipend.
Annual professional development budget.
Quarterly well-being stipend.
Considerable paid parental leave.
Employee referral bonus program.
Other benefits (life/AD&D, disability, EAP, etc.—varies by country).