[Remote] Security Operations Engineer

Note: The job is a remote job and is open to candidates in USA. AssemblyAI builds Voice AI models that power voice applications and APIs. The Security Operations Engineer will own day-to-day security operations and GRC activities, including compliance audits, control monitoring, risk reviews, vulnerability management, alert response, incident support, and security automation.

Responsibilities

• Drive SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles: gather and organize evidence, document, design, and build controls, coordinate directly with auditors through fieldwork, and collaborate with internal teams on remediation
• Own the compliance automation platform (Vanta): monitor control status, chase down failing checks, keep integrations healthy, and update the risk register as the business and infrastructure evolve
• Run vendor and third-party risk reviews, security assessments of new tools, periodic re-reviews, and track subprocessor and vendor inventories
• Partner with sales and legal responding to customer and vendor security questionnaires, RFP security sections, and trust-and-safety inquiries
• Drive vulnerability triage and prioritization across teams, tracking remediation against SLAs and reporting metrics to stakeholders
• Monitor and respond to alerts from endpoint, cloud, identity, and application security tools; investigate, escalate, and close the loop
• Support incident response for security events: evidence collection, timeline construction, documentation, and tracking of post-incident action items
• Maintain and improve security runbooks, process documentation, and operational playbooks
• Build automation to reduce the manual burden via scripts, integrations, reporting, and tooling

Skills

• 3+ years of experience in security operations, GRC, IT security, or a related role
• 2+ years of experience with compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors
• One or more security certifications—CISA, Security+, AWS Security Specialty, or equivalent
• Experience executing recurring security operations work: security reviews, vulnerability tracking, alert triage, or control monitoring
• Strong organization—you can run a multi-week evidence collection cycle across many stakeholders without dropping threads
• Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
• Proficiency in Python and comfort reading code written by others
• Experience using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
• Role is for US based candidates only
• Application security fundamentals: threat modeling, secure code review, or familiarity with common vulnerability classes (OWASP Top 10, CWE)
• Experience with security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, or IaC scanning—and routing findings to the right owners
• Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
• Working knowledge of cloud infrastructure (AWS preferred), including IAM concepts, and of identity and SaaS administration
• Experience building or maintaining SIEM detections, queries, and alerting pipelines
• Familiarity with endpoint security platforms and cloud security posture tooling
• Experience securing AI/ML systems or inference infrastructure
• Experience at a high-growth startup in a security role

Benefits

• Competitive equity grants
• 100% employer-paid benefits
• Fully remote work
• A 401k match up to 4% is offered to all US-based full time team members

Company Overview

Company H1B Sponsorship