Principal Engineer, Security & Compliance

TRSS; Eagan (MN); Hybrid; USD 159,000 - 295,000; Full time

Benefits offered by this job

Mental Health Days

Headspace app

401k with company match

Tuition Reimbursement

Employee Stock Purchase Plan

Job summary

Thomson Reuters seeks a Principal Software Engineer focused on Security & Compliance to set technical direction for trust, audits, and regulated data handling. You will own the architecture for controls, encryption, and production-scale systems across SOC 2, HIPAA, FedRAMP, and privacy programs.

You will partner with Security, Legal, Privacy and Product to translate requirements into engineering roadmaps, mentor engineers, and build trust through secure-by-design practices.

Qualifications

• Bachelor's Degree in CS/CE or related field, or equivalent experience.
• Hands-on production systems experience achieving SOC 2 Type II, ISO 27001 and HIPAA compliance.
• Experience with FedRAMP authorization processes at Moderate/High baseline.
• Deep backend engineering on AWS or similar cloud providers.
• Knowledge of NIST/NIST CSF, CIS Benchmarks and control mappings.
• Identity management at scale: SSO/SAML/OIDC/OAuth2, RBAC/ABAC, audit logging.

Responsibilities

• Own the compliance architecture across data pipelines and AI systems.
• Automate evidence collection, continuous control monitoring and policy-as-code.
• Design encryption, key management, data residency and tenant isolation for production scale.
• Lead cross‑functional initiatives with Security, Legal, Privacy and Product.
• Establish SLOs, observability and incident response for compliance-critical systems.

Skills

Backend engineering

Cloud (AWS)

IAM / SSO

Encryption & key management

Audit logging

Security & compliance leadership

Regulatory alignment

Cross-functional collaboration

Education

Bachelor's degree or equivalent

Tools

Python/Java/Go

SOC 2 / ISO 27001

FedRAMP

Job description

Thomson Reuters seeks a Principal Software Engineer focused on Security & Compliance to set technical direction for trust, audits, and regulated data handling. You will own the architecture for controls, encryption, and production-scale systems across SOC 2, HIPAA, FedRAMP, and privacy programs.

You will partner with Security, Legal, Privacy and Product to translate requirements into engineering roadmaps, mentor engineers, and build trust through secure-by-design practices.