Note: The job is a remote job and is open to candidates in USA. AssemblyAI builds Voice AI models that power voice applications and APIs. The Security Operations Engineer will own day-to-day security operations and GRC activities, including compliance audits, control monitoring, risk reviews, vulnerability management, alert response, incident support, and security automation.
Responsibilities
- Drive SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles: gather and organize evidence, document, design, and build controls, coordinate directly with auditors through fieldwork, and collaborate with internal teams on remediation
- Own the compliance automation platform (Vanta): monitor control status, chase down failing checks, keep integrations healthy, and update the risk register as the business and infrastructure evolve
- Run vendor and third-party risk reviews, security assessments of new tools, periodic re-reviews, and track subprocessor and vendor inventories
- Partner with sales and legal responding to customer and vendor security questionnaires, RFP security sections, and trust-and-safety inquiries
- Drive vulnerability triage and prioritization across teams, tracking remediation against SLAs and reporting metrics to stakeholders
- Monitor and respond to alerts from endpoint, cloud, identity, and application security tools; investigate, escalate, and close the loop
- Support incident response for security events: evidence collection, timeline construction, documentation, and tracking of post-incident action items
- Maintain and improve security runbooks, process documentation, and operational playbooks
- Build automation to reduce the manual burden via scripts, integrations, reporting, and tooling
Skills
- 3+ years of experience in security operations, GRC, IT security, or a related role
- 2+ years of experience with compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors
- One or more security certifications—CISA, Security+, AWS Security Specialty, or equivalent
- Experience executing recurring security operations work: security reviews, vulnerability tracking, alert triage, or control monitoring
- Strong organization—you can run a multi-week evidence collection cycle across many stakeholders without dropping threads
- Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
- Proficiency in Python and comfort reading code written by others
- Experience using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
- Role is for US based candidates only
- Application security fundamentals: threat modeling, secure code review, or familiarity with common vulnerability classes (OWASP Top 10, CWE)
- Experience with security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, or IaC scanning—and routing findings to the right owners
- Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
- Working knowledge of cloud infrastructure (AWS preferred), including IAM concepts, and of identity and SaaS administration
- Experience building or maintaining SIEM detections, queries, and alerting pipelines
- Familiarity with endpoint security platforms and cloud security posture tooling
- Experience securing AI/ML systems or inference infrastructure
- Experience at a high-growth startup in a security role
Benefits
- Competitive equity grants
- 100% employer-paid benefits
- Fully remote work
- A 401k match up to 4% is offered to all US-based full time team members
Company Overview
Company H1B Sponsorship