Staff Security Engineer

Mozilla

Staff Security Engineer advancing Mozilla’s information security management system and ISO 27001/SOC 2 programs. Leading audits, policies, remediation, and cross-functional compliance initiatives for an open-source technology company.

Posted 8/11/2026full-timeRemote • 🇺🇸 United StatesLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in maintaining and maturing Information Security Management Systems (ISMS) and supporting ISO 27001 and SOC 2 compliance audits. Proficient in policy creation, risk treatment planning, and collaborating with cross-functional teams to translate compliance requirements into actionable practices.

Highest-signal resume keywords

ISO 27001 ComplianceSOC 2 Audit ExecutionISMS MaintenanceSecurity Policy DevelopmentRisk Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecurityGRCCompliance AuditsRisk Treatment PlansManagement Review MeetingsSystem Description AuthorshipGap TrackingRemediation PlanningPolicy CreationCross-Functional Collaboration

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationIndependent OperationProcess BuildingStakeholder Engagement

Certifications & Qualifications

CISACISSPISO 27001 Lead AuditorISO 27001 Implementer

Industry Keywords

Compliance ScalingAudit RiskCertification ReadinessTrust Services CriteriaInternal Audit

About the role

Key responsibilities & impact

Maintain and mature the ISMS, including the Statement of Applicability (SoA), risk treatment plans, and the Management Review Meeting (MRM) process and cadence
Support ISO 27001 and SOC 2 Type 2 audit execution, including scope determination, evidence and narrative preparation, auditor interviews and walkthroughs, and resolution of auditor findings
Contribute to the SOC 2 System Description and other audit-specific narrative documentation
Track gaps and remediation efforts arising from readiness assessments and audits
Lead the security policy program, including policy creation, revision, and cross-functional review cycles
Support compliance scaling as additional products or business units pursue readiness assessments and certification
Support the internal audit function and partner with internal or third-party resources to meet ISO 27001 internal audit requirements
Partner with Engineering, IT, Legal, Privacy, People teams, and product leadership to gather evidence, drive control ownership, and translate compliance requirements into practical practices
Advise the GRC manager and Security leadership on audit risk, certification readiness, and compliance program strategy

Requirements

What you’ll need

5 years of experience in information security, GRC, or compliance-focused roles
Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria through audits from readiness through certification
Experience across the full breadth of an ISMS, including SoA maintenance, Management Review Meetings, and System Description authorship
Demonstrated experience writing and revising security policies and running cross-functional review cycles
Experience tracking gaps and remediation plans within compliance and risk programs
Ability to work with engineers, product managers, legal, and executive stakeholders and translate compliance requirements into actionable workflows
Ability to ramp up quickly and operate independently
Comfort building processes where none yet exist
Strong written and verbal communication skills and ability to represent Mozilla before external auditors
Relevant industry certifications such as CISA, CISSP, or ISO 27001 Lead Auditor/Implementer are a plus

Benefits

Comp & perks

Generous performance-based bonus plans to all eligible employees
Rich medical, dental, and vision coverage
Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute)
Quarterly all-company wellness days where everyone takes a pause together
Country-specific holidays plus a day off for your birthday
One-time home office stipend
Annual professional development budget
Quarterly well-being stipend
Considerable paid parental leave
Employee referral bonus program
Other benefits (life/AD&D, disability, EAP, etc.—varies by country)