Security Operations Engineer

• AssemblyAI runs a mature, multi-framework security and compliance program—including SOC 2 (all trust criteria), ISO 27001, and PCI 4.0—that protects the infrastructure and customer data behind our industry-leading Voice AI API
• We’re hiring a Security Operations Engineer to join our IT & Security team and take day-to-day ownership of the operational backbone of that program
• This role is centered on security operations and GRC: running compliance audit cycles end to end, gathering and organizing evidence, enforcing and verifying controls, executing access reviews, managing vulnerability triage and remediation follow-up, and responding to customer security questionnaires
• It’s the work that turns a security program on paper into one that demonstrably runs. You’ll also have room to grow the technical side of the role. We automate wherever we can, and you’ll be encouraged to build scripts, integrations, and tooling that reduce manual toil and improve the program
• This is a high-ownership role on a small team. You’ll work closely with engineers across the company, partner with sales and legal on customer-facing security needs, and have a direct hand in how AssemblyAI enforces security across its products, infrastructure, and internal tools—including a rapidly growing landscape of agentic AI development
• Drive SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles: gather and organize evidence, document, design, and build controls, coordinate directly with auditors through fieldwork, and collaborate with internal teams on remediation
• Own the compliance automation platform (Vanta): monitor control status, chase down failing checks, keep integrations healthy, and update the risk register as the business and infrastructure evolve
• Run vendor and third-party risk reviews, security assessments of new tools, periodic re-reviews, and track subprocessor and vendor inventories
• Partner with sales and legal responding to customer and vendor security questionnaires, RFP security sections, and trust-and-safety inquiries
• Drive vulnerability triage and prioritization across teams, tracking remediation against SLAs and reporting metrics to stakeholders
• Monitor and respond to alerts from endpoint, cloud, identity, and application security tools; investigate, escalate, and close the loop
• Support incident response for security events: evidence collection, timeline construction, documentation, and tracking of post-incident action items
• Maintain and improve security runbooks, process documentation, and operational playbooks
• Build automation to reduce the manual burden via scripts, integrations, reporting, and tooling

Benefits

• Home office stipend: We invest in our people first and offer competitive salaries across all roles andEvery new team member gets U$1,000 to improve their home office. We want to make sure everyone has the setup to do their best work. locations
• Equity: We want our team members to have skin in the game and an opportunity to see long-term returns on the hard work they are putting in. To that end, every team member receives a generous equity grant
• Premium benefit offerings: We offer premium medical, dental, and vision plans and cover up to 100% of the premiums for both the employee and their family. We also offer opportunities to contribute to an HSA or FSA, short-term and long-term disability coverage, and life insurance
• Unlimited PTO: We offer a flexible PTO policy to all team members and encourage everyone to take time off to recharge, do something fun, and spend time with loved ones
• Team offsites: We have team and company-wide retreats in amazing locations to give everyone an opportunity to meet in person, collaborate, and build working relationships that make us a better team
• Global remote team: We hire the best person for the job, regardless of location. Our remote-first culture allows team members to make an impact from anywhere in the world
• Diversity and inclusion: We celebrate diversity and are committed to creating an inclusive environment for all employees. We are proud to be an equal-opportunity workplace
• Flexible schedule: Strong teams are built on mutual trust and accountability. We believe in giving our team members ownership over their work and a flexible schedule to allow them to operate at their highest potential
• Role is for US based candidates only
• Experience using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
• Strong written communication skills—you’ll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
• Strong organization—you can run a multi-week evidence collection cycle across many stakeholders without dropping threads
• Proficiency in Python and comfort reading code written by others
• Experience executing recurring security operations work: security reviews, vulnerability tracking, alert triage, or control monitoring
• 3+ years of experience in security operations, GRC, IT security, or a related role
• 2+ years of experience with compliance audit cycles—you’ve gathered evidence, documented controls, and worked with auditors
• One or more security certifications—CISA, Security+, AWS Security Specialty, or equivalent
• Familiarity with endpoint security platforms and cloud security posture tooling
• Experience building or maintaining SIEM detections, queries, and alerting pipelines
• Application security fundamentals: threat modeling, secure code review, or familiarity with common vulnerability classes (OWASP Top 10, CWE)
• Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
• Working knowledge of cloud infrastructure (AWS preferred), including IAM concepts, and of identity and SaaS administration
• Experience securing AI/ML systems or inference infrastructure
• Experience with security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, or IaC scanning—and routing findings to the right owners
• Experience at a high-growth startup in a security role