Senior Software Engineer, Security

AssemblyAI builds best-in-class Voice AI models and is seeking a Senior Software Engineer in the security domain to join their IT & Security team. The role involves hands-on engineering work in security as well as operational tasks to maintain the company's security and compliance program.

Responsibilities:

• Conduct threat modeling and security design reviews for new features, services, and architectural changes—partnering with product and platform engineers early in the design phase
• Perform secure code reviews and provide actionable feedback, focusing on authentication, authorization, input handling, secrets management, and data protection
• Deploy and maintain security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, IaC scanning, and CI/CD security guardrails
• Support best practices to adopt secure-by-default libraries, frameworks, paved-road patterns, and developer guidance to reduce classes of vulnerabilities across the codebase
• Partner with platform engineering on infrastructure and environment security—including AWS resource hardening, Terraform-managed infrastructure reviews, network segmentation, and environment isolation improvements
• Contribute to incident response for security events: investigation, root cause analysis, and post-incident hardening
• Drive vulnerability triage and prioritization across teams, tracking remediation against targets and reporting metrics. Step in to remediate directly through patches and PRs where you identify high-impact opportunities
• Partner with sales and legal responding to customer and vendor questionnaires, RFP security sections, and trust-and-safety inquiries
• Support SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles by gathering evidence, documenting controls, and coordinating with auditors
• Monitor and respond to alerts from endpoint, cloud, and application security tools; manage vulnerability tracking and remediation follow-up across the environment
• Execute recurring user access reviews, IAM hygiene tasks, and RBAC maintenance required by compliance frameworks
• Maintain and improve security runbooks, process documentation, and operational playbooks—building automation where possible to reduce manual burden using AI-assisted development tools

Requirements:

• 5+ years of experience in security engineering, security operations, or a related role that combined both
• Hands-on experience with at least one of SOC 2, ISO 27001, or PCI compliance audit cycles—you've gathered evidence, documented controls, and worked with auditors, not just read about it
• Strong application security fundamentals: threat modeling, secure code review, and familiarity with common vulnerability classes (OWASP Top 10, CWE)
• Experience with security tooling across the development lifecycle: SAST, SCA, DAST, secret scanning, or IaC scanning
• Working knowledge of AWS infrastructure and services, including IAM, VPC networking, and security configurations
• Familiarity with infrastructure-as-code (Terraform preferred) and CI/CD pipeline security
• Proficiency in Python and comfort reading code across backend services
• Strong written communication skills—you'll write audit documentation, security questionnaire responses, policy documents, and runbooks regularly
• Comfort using AI-assisted development tools (e.g., Claude Code, Copilot, or similar) to write scripts, build automations, and accelerate documentation—AI tool fluency is a core expectation at AssemblyAI
• Experience securing AI/ML systems or inference infrastructure
• Familiarity with endpoint security platforms and cloud security tooling
• Security incident handling experience: building SIEM detections, writing queries, managing alerting and triage pipelines
• Experience with vulnerability management programs: building triage workflows, managing SLAs, and reporting metrics
• Security certifications (CISSP, CSSLP, AWS Security Specialty, or equivalent)
• Experience at a high-growth startup in a security role