Note: The job is a remote job and is open to candidates in USA. AssemblyAI builds best-in-class Voice AI models and is seeking a Senior Software Engineer in the security domain to join their IT & Security team. The role involves hands-on engineering work in security as well as operational tasks to maintain the company's security and compliance program.
Responsibilities
- Conduct threat modeling and security design reviews for new features, services, and architectural changes—partnering with product and platform engineers early in the design phase
- Perform secure code reviews and provide actionable feedback, focusing on authentication, authorization, input handling, secrets management, and data protection
- Deploy and maintain security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, IaC scanning, and CI/CD security guardrails
- Support best practices to adopt secure-by-default libraries, frameworks, paved-road patterns, and developer guidance to reduce classes of vulnerabilities across the codebase
- Partner with platform engineering on infrastructure and environment security—including AWS resource hardening, Terraform-managed infrastructure reviews, network segmentation, and environment isolation improvements
- Contribute to incident response for security events: investigation, root cause analysis, and post-incident hardening
- Drive vulnerability triage and prioritization across teams, tracking remediation against targets and reporting metrics. Step in to remediate directly through patches and PRs where you identify high-impact opportunities
- Partner with sales and legal responding to customer and vendor questionnaires, RFP security sections, and trust-and-safety inquiries
- Support SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles by gathering evidence, documenting controls, and coordinating with auditors
- Monitor and respond to alerts from endpoint, cloud, and application security tools; manage vulnerability tracking and remediation follow-up across the environment
- Execute recurring user access reviews, IAM hygiene tasks, and RBAC maintenance required by compliance frameworks
- Maintain and improve security runbooks, process documentation, and operational playbooks—building automation where possible to reduce manual burden using AI-assisted development tools
Skills
- 5+ years of experience in security engineering, security operations, or a related role that combined both
- Hands-on experience with at least one of SOC 2, ISO 27001, or PCI compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors, not just read about it
- Strong application security fundamentals: threat modeling, secure code review, and familiarity with common vulnerability classes (OWASP Top 10, CWE)
- Experience with security tooling across the development lifecycle: SAST, SCA, DAST, secret scanning, or IaC scanning
- Working knowledge of AWS infrastructure and services, including IAM, VPC networking, and security configurations
- Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
- Proficiency in Python and comfort reading code across backend services
- Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
- Comfort using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
- Experience securing AI/ML systems or inference infrastructure
- Familiarity with endpoint security platforms and cloud security tooling
- Security incident handling experience: building SIEM detections, writing queries, managing alerting and triage pipelines
- Experience with vulnerability management programs: building triage workflows, managing SLAs, and reporting metrics
- Security certifications (CISSP, CSSLP, AWS Security Specialty, or equivalent)
- Experience at a high-growth startup in a security role
Benefits
- 100% employer-paid benefits
- Flexibility of being fully remote
- A 401k match up to 4% is offered to all US-based full time team members
Company Overview