Principal Security & Compliance Engineer (Hybrid)

Thomson Reuters; Eagan (MN); Hybrid; USD 159,000 - 295,000; Full time

Benefits offered by this job

Hybrid work model

Comprehensive benefits

Job summary

Thomson Reuters is seeking a Principal Software Engineer, Security & Compliance, to define technical direction for SOC 2, ISO 27001, HIPAA, and FedRAMP. You will own the architecture, implement security controls in cloud infrastructure, and partner with auditors and cross-functional teams to ensure trust and compliance at scale.

You will drive automated evidence collection, policy-as-code, and secure-by-design practices while leading a team of engineers in a hybrid work environment.

Qualifications

• Direct, hands-on experience building or operating production systems achieving SOC 2 Type II and ISO 27001 (and/or 42001).
• Experience supporting a FedRAMP authorization process (Moderate or High).
• Deep backend engineering experience with Python, Java, Go, or similar; cloud deployments on AWS.

Responsibilities

• Own the compliance architecture across SOC 2 Type II, ISO 27001/42001, HIPAA, and FedRAMP.
• Build compliance as code with automated evidence collection and policy-as-code.
• Design encryption, key management, data residency, tenant isolation, and audit logging at scale.
• Lead cross-functional collaboration with Security, Legal, Privacy, and Product to map requirements to engineering roadmaps.
• Establish SLOs, observability, and incident response for compliance-critical systems.

Skills

Backend engineering

Cloud security

IAM at scale

Encryption & key management

Audit logging

Threat modeling

SRE/Observability

Communication with auditors

Education

Bachelor's Degree in Computer Science or related field

Tools

AWS

Security control frameworks (NIST 800-53 / CIS)

GRC automation tools (Vanta/Drata/OneTrust)

Job description

Thomson Reuters is seeking a Principal Software Engineer, Security & Compliance, to define technical direction for SOC 2, ISO 27001, HIPAA, and FedRAMP. You will own the architecture, implement security controls in cloud infrastructure, and partner with auditors and cross-functional teams to ensure trust and compliance at scale.

You will drive automated evidence collection, policy-as-code, and secure-by-design practices while leading a team of engineers in a hybrid work environment.