Principal Engineer, Security & Compliance (Trust & Scale)

TRSS; Ann Arbor (MI); Hybrid; USD 159,000 - 295,000; Full time

Benefits offered by this job

Hybrid Work Model

Flexible Work Arrangements

Career Development

Mental Health Days

Tuition Reimbursement

Retirement Savings

Job summary

Thomson Reuters is seeking a Principal Engineer, Security & Compliance to set the technical direction for SOC 2, ISO 27001/42001, HIPAA, and FedRAMP across our infrastructure and data pipelines. You will own the architecture and governance for secure, auditable systems handling privileged data.

You’ll partner with Security, Legal, Privacy, and Product to translate regulatory requirements into engineering roadmaps, automate evidence collection, and advance secure-by-design practices at scale.

Qualifications

• Bachelor degree in CS, engineering or equivalent.
• Proven experience building/operating systems with SOC 2 Type II, ISO 27001/42001 and HIPAA.
• FedRAMP authorization experience at Moderate/High baseline.
• Backend engineering with Python/Java/Go on AWS and native controls.
• Knowledge of NIST 800-53/CSF or CIS benchmarks and mapping controls.
• Identity management at scale (SSO, SAML, OAuth2, RBAC/ABAC).
• End-to-end ownership of large security initiatives—architecture to operations.
• Strong cross-functional collaboration with auditors, security, legal, product, and eng.

Responsibilities

• Own the compliance architecture across SOC 2, ISO 27001/42001, HIPAA, and FedRAMP.
• Automate evidence collection and policy-as-code for audits.
• Design encryption, key management, data residency, tenant isolation, and audit logging.
• Partner with Security, Legal, Privacy, and Product to translate requirements into roadmaps.
• Establish SLOs, observability, and incident response for compliance-critical systems.

Skills

Backend engineering

Security architecture

Compliance & audits

Cloud security (AWS)

Identity and access management

Threat modeling

Communication with auditors

Education

Bachelor's Degree in Computer Science or related field

Tools

AWS

GRC tooling (Vanta/Drata/OneTrust)

Job description

Thomson Reuters is seeking a Principal Engineer, Security & Compliance to set the technical direction for SOC 2, ISO 27001/42001, HIPAA, and FedRAMP across our infrastructure and data pipelines. You will own the architecture and governance for secure, auditable systems handling privileged data.

You’ll partner with Security, Legal, Privacy, and Product to translate regulatory requirements into engineering roadmaps, automate evidence collection, and advance secure-by-design practices at scale.