Senior Engineer, Security & Compliance (US)

• 5+ years of hands-on security engineering experience, ideally spanning SaaS product environments and/or professional services/agency delivery
• Deep practical knowledge of cloud security in at least one major platform (GCP, AWS, or Azure) — IAM, networking, secrets management, logging, and security tooling
• Hands-on experience with SOC 2 Type II and ISO 27001 control implementation — not just familiarity with frameworks, but actually building and operating the controls
• Experience building security automation across CI/CD pipelines — integrating vulnerability scanners, SAST/DAST tools, and policy enforcement into engineering workflows
• Working knowledge of privacy regulations (HIPAA, GDPR, CCPA/CPRA) and experience implementing technical controls that operationalize compliance requirements
• Proficiency with security monitoring and SIEM tooling — building detection logic, tuning alerts, and responding to incidents with real technical depth
• Strong communication skills — you can explain a complex finding clearly to an engineer, a PM, or a client, and write a crisp, credible response to a security questionnaire
• Comfort working across a distributed, fast-moving organization with multiple concurrent workstreams
• Experience working with AI-enabled development tools and integrating security thinking into AI-assisted workflows
• Hands-on experience reviewing and hardening AI agent workflows — understanding risks like prompt injection, data leakage, and model misuse in production systems
• Comfortable leveraging AI-enabled development tools and workflows to accelerate engineering, automation, debugging, and operational tasks
• Experience orchestrating multi-step AI or agent-driven workflows, including selecting appropriate models, tools, and execution patterns for different use cases
• Strong judgment reviewing and hardening AI-assisted output for security, scalability, maintainability, and architectural fit
• Experience building or maintaining prompts, evaluation frameworks, documentation, or operational context systems that improve engineering velocity and reliability
• Familiarity with automated evaluation and feedback loops for AI-enabled systems and workflows

• Experience in agency, consultancy, or enterprise SaaS environments where you've had to meet varying client security requirements
• Familiarity with ISO 42001 and AI governance frameworks
• Experience securing multi-tenant SaaS architectures at the infrastructure and application layer
• Relevant certifications: CISSP, CCSP, AWS/GCP/Azure Security Specialty, CIPP, or similar
• Experience with infrastructure-as-code security tooling (e.g., Checkov, tfsec, OPA/Rego)

Born in 2001, Code and Theory is a digital-first creative agency that sits at the center of creativity and technology.

We pride ourselves on not only solving consumer and business problems, but also helping to establish new capabilities for our clients.

With a global client roster of Fortune 100s and start-ups alike, we crave the hardest problems to solve.

We have teams distributed across North America, South America, Europe, and Asia.

The Code and Theory global network of agencies is growing and includes Kettle, Instrument, Left Field Labs, Create Group, Current, and TrueLogic.

Striving never to be pigeonholed, we work across every major category: from tech to CPG, financial services to travel & hospitality, government and education to media and publishing.

We value the collaboration with our client partners, including but not limited to Adidas, Amazon, Con Edison, Diageo, EY, J.P.

Morgan Chase, Lenovo, Marriott, Mars, Microsoft, Thomson Reuters, and TikTok.

The Code and Theory network is comprised of nearly 2,000 people with 50% engineers and 50% creative talent.

We’re always on the lookout for smart, driven, and forward-thinking people to join our team.

The base compensation range for this role is $110,000 – $150,000 and spans multiple levels.

We're open to hiring at the level that best matches the right candidate's experience.

Actual compensation is influenced by a wide array of factors including but not limited to skill set, level of experience, budget, and location.