Senior Security & Compliance Platform Engineer

CampusIQ | North Austin, TX | Hybrid | Full-time

AI is how you build here, not what you build.

The job in one line

Own security and compliance for a company where twenty-one people ship production code, most of them through agents. Then run those robots yourself. That's the second half of the job.

Why this isn't a normal security role

Nobody has a finished playbook for securing a company that works this way. That's the interesting part.

What does least privilege mean when the thing taking the action is an agent? What does an audit trail look like when work is drafted once and built by a machine? Those questions are open at every company building the way we build. You'd answer them here.

We want the controls built and automated, with the robots. Most companies our size hire a team to hold them up by hand, then live with it for years. We won't.

A control verified continuously beats one a person spot-checks each quarter. Done right, the posture gets more rigorous and less manual at the same time.

What you'd own

• SOC 2 Type 2 — the program, end to end. You pick the tooling, run the evidence, and sit across from the auditor.
• GovRAMP Core (GovRAMP was StateRAMP) — getting us there.
• Agentic operations — permissions, audit trails, and guardrails for agents that ship production code every day. Nobody sells this. You'd build it.
• The security foundation a company under thirty people has to build anyway.

You'd own all of it. You wouldn't build all of it.

The model providers give you some. The platforms give you some. You build the part nobody sells, and you automate the rest. That's maybe thirty percent, and it's the part that matters.

We're not hiring someone to rubber-stamp

Several of our customers employ serious security teams. They see through theater in about ten minutes.

Our standard is that a control holds because it holds, and the audit confirms what was already true. That's the bar you'd keep.

Universities ask hard questions about how their data moves. They're right to. Answering them well, in writing, under scrutiny, is part of this seat.

Where this goes after the audits

Compliance has a shape everyone in this field knows. A hard push into each audit, then a long treadmill collecting the same evidence over and over. Most companies staff that treadmill forever.

We intend to automate it.

As the machine takes over the routine, the role expands. You learn to run the robots — and we teach you that part, deliberately. The head of engineering runs the machine today and would train you on it. That training is the thing you can't buy anywhere else, and you'd take it with you.

Then we point you at what's next. Sales automation, the services side, the thing we haven't named yet.

Which means the honest promise is this: you're going to have time. Most security roles never give you any. That's the offer.

If you want to be the compliance person for the next five years, this is a bad job for you. If you've done compliance for years and you're tired of only being the compliance person, keep reading.

Who this is for

Someone who's taken a company through SOC 2 and doesn't need it explained.

Someone who's held a real control standard against an auditor and made it stick.

Technically minded — you read code, not just policy.

And the non-negotiable: you can tell when the robot is lying to you.

We've had one person in mind the whole time we wrote this. Someone who's run compliance more than once, which is exactly why the novelty has worn off. Bored. Still technical. Still wants to build.

What we're not looking for

Someone who needs convincing that AI changes how this work gets done.

Traditional habits work against people here. They nod along, agree, then go back to doing it the old way. The muscle memory is too strong.

The people who do well here were already using this stuff before we met them.

What we can and can't teach

We can teach you our system, and we will. That's the deal.

We can't teach the wanting.

Nobody who succeeded here waited for permission. Before we ever tested them, they were already building with these tools on their own time — because they wanted to, not because anyone assigned it.

That's what the assignment is actually asking.

How this works

Start here. Have your AI send us a synopsis of what you built in the last thirty days. Business, personal, we don't care. If you haven't built anything, that's an answer too.

If that lands, we'll send you an assignment. It takes a few evenings and there's no deadline.

Install Claude Code. Install the Superpowers plugin. Then build something you'll actually use — in a domain you know cold, where you'll spot a wrong answer the second you see it. Small is fine. Real is the point. Ship it. Use it daily. Keep fixing it.

Then tell us what you built, what you learned, and how it felt different.

We're not grading polish. Most people can't show us something impressive, and we don't expect it. We're looking for whether you took it seriously, built something interesting, and learned from it.

The thing we care most about isn't whether it runs. It's whether you can tell when the robot is lying to you. That's the whole game.

They don't need to be convinced. They need to be pointed. If that sentence describes you, we should talk.

How to apply

Complete the form on campusiq.com/careers. Select this role from the position list and include a resume.

CampusIQ is an equal opportunity employer.