Senior Security & Compliance Platform Engineer

CampusIQ; Austin, Northern (TX, KY); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity

Job summary

CampusIQ in North Austin, TX is seeking a Senior Security & Compliance Platform Engineer to own the security program from end to end. You’ll implement SOC 2 Type 2 and GovRAMP Core controls, automate evidence collection, and work with auditors.

This role focuses on agentic operations and the security foundation for a small but fast-moving team. You’ll design guardrails for production code shipped by robots, drive continuous improvement, and shape the posture as the company scales.

Qualifications

• Experience delivering SOC 2 Type 2 program end-to-end.
• Experience pursuing GovRAMP Core and related audits.
• Ability to design automated security controls for a small team.

Responsibilities

• Own security and compliance for SOC 2 Type 2 and GovRAMP Core.
• Automate evidence collection and drive auditor readiness.
• Develop guardrails for agent-driven production code and security posture.

Skills

SOC 2 Type 2

GovRAMP Core

Agentic operations

Security foundations

Job description

Senior Security & Compliance Platform Engineer

CampusIQ | North Austin, TX | Hybrid | Full-time

At a glance

Location North Austin, TX. Hybrid.

Type Full-time

You own SOC 2 Type 2, GovRAMP Core, agentic operations, and the security foundation

Compensation $180–240K + equity

AI is how you build here, not what you build.

Own security and compliance for a company where twenty-one people ship production code, most of them through agents. Then run those robots yourself. That's the second half of the job.

Why this isn't a normal security role

Nobody has a finished playbook for securing a company that works this way. That's the interesting part.

What does least privilege mean when the thing taking the action is an agent? What does an audit trail look like when work is drafted once and built by a machine? Those questions are open at every company building the way we build. You'd answer them here.

We want the controls built and automated, with the robots. Most companies our size hire a team to hold them up by hand, then live with it for years. We won't.

A control verified continuously beats one a person spot-checks each quarter. Done right, the posture gets more rigorous and less manual at the same time.

What you'd own

• SOC 2 Type 2 — the program, end to end. You pick the tooling, run the evidence, and sit across from the auditor.
• GovRAMP Core (GovRAMP was StateRAMP) — getting us there.
• Agentic operations — permissions, audit trails, and guardrails for agents that ship production code every day. Nobody sells this. You'd build it.
• The security foundation a company under thirty people has to build anyway.

You'd own all of it. You wouldn't build all of it.

The model providers give you some. The platforms give you some. You build the part nobody sells, and you automate the rest. That's maybe thirty percent, and it's the part that matters.

We’re not hiring someone to rubber-stamp

Several of our customers employ serious security teams. They see through theater in about ten minutes.

Our standard is that a control holds because it holds, and the audit confirms what was already true. That's the bar you'd keep.

Universities ask hard questions about how their data moves. They’re right to. Answering them well, in writing, under scrutiny, is part of this seat.

Where this goes after the audits

Compliance has a shape everyone in this field knows. A hard push into each audit, then a long treadmill collecting the same evidence over and over. Most companies staff that treadmill forever.

We intend to automate it.

As the machine takes over the routine, the role expands. You learn to run the robots — and we teach you that part, deliberately. The head of engineering runs the machine today and would train you on it. That training is the thing you can't buy anywhere else, and you’d take it with you.

Then we point you at what’s next. Sales automation, the services side, the thing we haven’t named yet.

Which means the honest promise is this: you’re going to have time. Most security roles never give you any. That’s the offer.

If you want to be the compliance person for the next five years, this is a bad job for you. If you’ve done compliance for years and you’re tired of only being the compliance person, keep reading.

Who this is for

Someone who’s taken a company through SOC 2 and doesn’t need it explained.

Someone who’s held a real control standard against an auditor and made it stick.

Technically minded — you read code, not just policy.

And the non-negotiable: you can tell when the robot is lying to you.

We’ve had one person in mind the whole time we wrote this. Someone who’s run compliance more than once, which is exactly why the novelty has worn off. Bored. Still technical. Still wants to build.

What we’re not looking for

Someone who needs convincing that AI changes how this work gets done.

Traditional habits work against people here. They nod along, agree, then go back to doing it the old way. The muscle memory is too strong.

The people who do well here were already using this stuff before we met them.

What we can and can’t teach

We can teach you our system, and we will. That’s the deal.

We can’t teach the wanting.

Nobody who succeeded here waited for permission. Before we ever tested them, they were already building with these tools on their own time — because they wanted to, not because anyone assigned it.

That’s what the assignment is actually asking.

How this works

Start here. Have your AI send us a synopsis of what you built in the last thirty days. Business, personal, we don’t care. If you haven’t built anything, that’s an answer too.

If that lands, we’ll send you an assignment. It takes a few evenings and there’s no deadline.

Install Claude Code. Install the Superpowers plugin. Then build something you’ll actually use — in a domain you know cold, where you’ll spot a wrong answer the second you see it. Small is fine. Real is the point. Ship it. Use it daily. Keep fixing it.

Then tell us what you built, what you learned, and how it felt different.

We’re not grading polish. Most people can't show us something impressive, and we don’t expect it. We’re looking for whether you took it seriously, built something interesting, and learned from it.

The thing we care most about isn’t whether it runs. It’s whether you can tell when the robot is lying to you. That’s the whole game.

They don’t need to be convinced. They need to be pointed. If that sentence describes you, we should talk.