Security Operations Engineer

Join AssemblyAI, a leading Voice AI API company, as a Security Operations Engineer. In this role, you will take ownership of the operational backbone of our security and compliance program, including SOC 2, ISO 27001, and PCI 4.0. You will work closely with engineers across the company, partner with sales and legal on customer-facing security needs, and have a direct impact on how AssemblyAI enforces security across its products, infrastructure, and internal tools. This is a high-ownership role on a small team, with opportunities for growth and automation.

• Assumer la responsabilité quotidienne de l'exploitation du programme de sécurité et de conformité de l'entreprise, y compris la gestion des cycles d'audit de conformité.
• Gérer la plateforme d'automatisation de la conformité (Vanta), surveiller l'état des contrôles, poursuivre les vérifications échouées et mettre à jour le registre des risques.
• Collaborer avec les équipes internes pour la remédiation, la triage des vulnérabilités et la réponse aux alertes de sécurité.

• Role is for US based candidates only
• Experience using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
• Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
• Strong organization—you can run a multi-week evidence collection cycle across many stakeholders without dropping threads
• Proficiency in Python and comfort reading code written by others
• Experience executing recurring security operations work: security reviews, vulnerability tracking, alert triage, or control monitoring
• 3+ years of experience in security operations, GRC, IT security, or a related role
• 2+ years of experience with compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors
• One or more security certifications—CISA, Security+, AWS Security Specialty, or equivalent
• Familiarity with endpoint security platforms and cloud security posture tooling
• Experience building or maintaining SIEM detections, queries, and alerting pipelines
• Application security fundamentals: threat modeling, secure code review, or familiarity with common vulnerability classes (OWASP Top 10, CWE)
• Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
• Working knowledge of cloud infrastructure (AWS preferred), including IAM concepts, and of identity and SaaS administration
• Experience securing AI/ML systems or inference infrastructure
• Experience with security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, or IaC scanning—and routing findings to the right owners
• Experience at a high-growth startup in a security role