Security Operations Engineer

Job description

### **Why AssemblyAI** AssemblyAI builds the best-in-class Voice AI models powering the next generation of voice applications. We have a lab, and we also power our own models in our own proprietary inference environment. Our models serve 500M+ inference calls monthly, and process nearly 2 million hours of audio daily. The Voice AI space is at an inflection point; we’re looking for the best talent we can find to join a rapidly scaling team that's defining the future of the industry. We are one of the most capital-efficient AI companies on the planet - and are rapidly approaching $1M ARR per employee. We sit among the top 5 most revenue-dense teams within the fastest-growing AI companies today. We have thousands of customers building with us including the top startups and world-renowned enterprises, and are serving at tremendous scale: we process nearly 2 million hours of audio daily and handle more than 15 million API calls every day. This is a rare growth-stage opportunity where the business is proven, the revenue is durable, and the growth trajectory is steep and getting steeper. We have a super flat culture and expect our employees to be deeply intimate with the details at all levels. If you've ever felt buried under layers of bureaucracy, starved of real ownership, or frustrated watching your work disappear into a slow-moving org, AssemblyAI is built differently. The company operates as a true meritocracy, with no heavy planning or approval processes and no gatekeeping on the tools or information you need. For anyone who genuinely cares about voice AI, not as a trend to chase, but as a technology to build, this is the place where the most interesting problems at the most interesting scale are being solved by a team small enough that you'll actually know everyone's name. ## **About the role:** AssemblyAI runs a mature, multi-framework security and compliance program—including SOC 2 (all trust criteria), ISO 27001, and PCI 4.0—that protects the infrastructure and customer data behind our industry-leading Voice AI API. We're hiring a Security Operations Engineer to join our IT & Security team and take day-to-day ownership of the operational backbone of that program. This role is centered on security operations and GRC: running compliance audit cycles end to end, gathering and organizing evidence, enforcing and verifying controls, executing access reviews, managing vulnerability triage and remediation follow-up, and responding to customer security questionnaires. It's the work that turns a security program on paper into one that demonstrably runs. You'll also have room to grow the technical side of the role. We automate wherever we can, and you'll be encouraged to build scripts, integrations, and tooling that reduce manual toil and improve the program. This is a high-ownership role on a small team. You'll work closely with engineers across the company, partner with sales and legal on customer-facing security needs, and have a direct hand in how AssemblyAI enforces security across its products, infrastructure, and internal tools—including a rapidly growing landscape of agentic AI development. ## **What You'll Do:** - Drive SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles: gather and organize evidence, document, design, and build controls, coordinate directly with auditors through fieldwork, and collaborate with internal teams on remediation. - Own the compliance automation platform (Vanta): monitor control status, chase down failing checks, keep integrations healthy, and update the risk register as the business and infrastructure evolve. - Run vendor and third-party risk reviews, security assessments of new tools, periodic re-reviews, and track subprocessor and vendor inventories. - Partner with sales and legal responding to customer and vendor security questionnaires, RFP security sections, and trust-and-safety inquiries. - Drive vulnerability triage and prioritization across teams, tracking remediation against SLAs and reporting metrics to stakeholders. - Monitor and respond to alerts from endpoint, cloud, identity, and application security tools; investigate, escalate, and close the loop. - Support incident response for security events: evidence collection, timeline construction, documentation, and tracking of post-incident action items. - Maintain and improve security runbooks, process documentation, and operational playbooks. - Build automation to reduce the manual burden via scripts, integrations, reporting, and tooling. ## **What You'll Need:** - 3+ years of experience in security operations, GRC, IT security, or a related role - 2+ years of experience with compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors - One or more security certifications—CISA, Security+, AWS Security Specialty, or equivalent - Experience executing recurring security operations work: security reviews, vulnerability tracking, alert triage, or control monitoring - Strong organization—you can run a multi-week evidence collection cycle across many stakeholders without dropping threads - Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly - Proficiency in Python and comfort reading code written by others - Experience using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI - Role is for US based candidates only ### **Nice to have** - Application security fundamentals: threat modeling, secure code review, or familiarity with common vulnerability classes (OWASP Top 10, CWE) - Experience with security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, or IaC scanning—and routing findings to the right owners - Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security - Working knowledge of cloud infrastructure (AWS preferred), including IAM concepts, and of identity and SaaS administration - Experience building or maintaining SIEM detections, queries, and alerting pipelines - Familiarity with endpoint security platforms and cloud security posture tooling - Experience securing AI/ML systems or inference infrastructure - Experience at a high-growth startup in a security role **Pay Transparency:** AssemblyAI strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on paying competitively for our size, stage, and industry, and are one part of many compensation, benefit, and other reward opportunities we provide. There are many factors that go into salary determinations, including relevant experience, skill level, qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. The provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range which will be communicated to candidates throughout the interview process. **Salary range:** $180,000 - $220,000 USD The expected base compensation for this role is listed above. Our total compensation package includes competitive equity grants, 100% employer-paid benefits, and the flexibility of being fully remote. A 401k match up to 4% is offered to all US-based full time team members. **Using AI in your interview** If you’re selected for an interview, please read our [Candidate AI Guidance](https://www.assemblyai.com/candidate-ai-guidance). It explains how you can use AI at each stage of our process, from your application and take-home to the interviews themselves. **GDPR privacy notice** If you’re applying from the EU or UK, please review our [Job Applicant Privacy Notice](https://www.assemblyai.com/legal/gdpr-job-applicant-and-worker-privacy-notice) before applying. **Keep exploring AssemblyAI** **Transcribe:** [Speech-to-Text](https://www.assemblyai.com/products/speech-to-text) | [Streaming Speech-to-Text](https://www.assemblyai.com/products/streaming-speech-to-text) **Understand:** [Speech Understanding](https://www.assemblyai.com/products/speech-understanding) | [LLM Gateway](https://www.assemblyai.com/products/llm-gateway) **Interact:** [Voice Agent API](https://www.assemblyai.com/products/voice-agent-api) | [Dictation API](https://www.assemblyai.com/products/dictation-api) [Try our models in the Playground](https://www.assemblyai.com/playground) [See how 50+ LLMs rank on real voice tasks: Voice Standard Bench](https://www.assemblyai.com/blog/voice-standard-bench) [Watch us on YouTube](https://www.youtube.com/@AssemblyAI)