Security & Compliance Engineer

Aurelian

Seattle (WA)

On-site

USD 160,000 - 210,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Comprehensive Medical, Dental, Vision

Life insurance

401(k)

Unlimited PTO

Office in Seattle

Relocation assistance

Daily delivered lunches

Start-up Equity

Equipment stipend

Job summary

Aurelian in Seattle is seeking a hands-on security engineer with program leadership to own SOC 2 and CJIS compliance while strengthening cloud security.

You will partner with engineering, sales, and audits to iterate processes, build a durable security system that scales across agencies, and protect sensitive data. This role blends hands-on security work with program ownership in a fast-growing public-safety tech company.

Qualifications

5–8 years across security engineering and GRC.
Experience with SOC 2 and CJIS Security Policy, NIST 800-53/800-171, or FedRAMP.
Ability to work hands-on in cloud environments (Azure) and automate controls.
Communicate effectively with auditors and cross-functional teams.

Responsibilities

Own security posture end-to-end and maintain accuracy across documents, questionnaires, and contracts.
Run the compliance program for SOC 2 and CJIS; manage data policies and incident response plans.
Turn security reviews into a streamlined process; manage the security-questionnaire pipeline.
Harden cloud infrastructure (Azure), IAM, network isolation, and secure dev practices.
Automate evidence collection and compliance tooling; practice as code.
Operate personnel security processes: background checks, training, access controls.

Skills

Security engineering

GRC experience

SOC 2 familiarity

CJIS/Security Policy knowledge

NIST 800-53/800-171

Cloud security (Azure)

IAM & network isolation

Automation & scripting

Auditing & evidence handling

Auditor communication

Tools

Azure

GRC tooling

Job description

About Aurelian

Aurelian builds AI tools that help 911 centers handle more with less, so telecommunicators can stay focused on what matters most and communities get the response they need.

AVA is a conversational AI agent that answers non-emergency calls; the agent routes, triages, and resolves the calls without any human intervention. By handling administrative calls like noise complaints, lost dogs, and parking inquiries, AVA eliminates hold times and lets call-takers focus their energy on actual emergencies.

CORA supports call-takers on the calls that matter most. CORA is an on-screen assistant that delivers real-time SOP checklists, smart reminders, and contextual guidance as an emergency call unfolds, so dispatchers stay calm, consistent, and confident when every second counts. When AVA detects an emergency mid-call, it transfers the caller to a telecommunicator and passes along the caller details, location, incident type, and key statements directly into CORA. The call-taker never starts from scratch.

The problem we're solving is serious. The average emergency communications center is 30% understaffed nationwide. Staffing shortages drive burnout and attrition, which makes the shortage worse. Meanwhile, 60-80% of the calls coming in aren't even emergencies at all. Aurelian addresses both sides of that equation: AVA reduces unnecessary call volume, and CORA makes every emergency call more manageable for the people handling it.

Aurelian is live in centers across the country, answering thousands of non-emergency calls every day, and is backed by New Enterprise Associates and Y Combinator. Aurelian is growing rapidly; we are hiring people who want to help scale this work and make a real difference in public safety infrastructure for communities across the country.

Why Join Us

We handle criminal justice information for public-safety agencies. That means security and compliance aren't a back-office function at Aurelian - they're on the critical path of every deal we close and every center we go live in. Today that work is spread across our CTO and engineering leadership. We're hiring our first dedicated security and compliance owner to take it end-to-end - and to build it as a system we can scale.

This is a genuinely hybrid role: roughly half hands-on security engineering and half compliance program ownership. You'll harden the systems that handle 9-1-1 call data and own the SOC 2 and CJIS programs, the customer security questionnaires, and the artifacts that make our security posture legible to the agencies who trust us. If you want a seat where security work directly protects people in their worst moments — and where you get to define the function from the ground up — this is it.

What You'll Be Doing

Own our security posture end-to-end: Be the single source of truth for how Aurelian handles sensitive data. Keep our security claims accurate, consistent, and defensible across every document, questionnaire, and contract.
Run the compliance program: Own SOC 2 and our alignment to the CJIS Security Policy (and FedRAMP/GovCloud as our gov pipeline grows). Own the artifacts that don't fully exist yet - subprocessor lists, data management and retention policies, incident response plans - and keep them current.
Turn security reviews from a bottleneck into a process: Own the customer security-questionnaire pipeline so deals don't wait on engineering. Work directly with our implementation and sales teams to get agencies the answers they need, quickly and accurately.
Do the engineering, not just the paperwork: Harden our cloud infrastructure (Azure), tighten IAM and tenant isolation, improve logging/audit and detection, and shore up our secure development practices.
Automate the compliance grind: Wire up and operate compliance-automation tooling so evidence collection, continuous controls monitoring, and questionnaire responses run as close to hands-off as possible. Treat compliance as code.
Operationalize personnel security: Run the processes CJIS requires across engineering - background checks / fingerprinting, security-awareness training, and access controls for anyone who touches criminal justice information.

Who We're Looking For

A builder who can also run the program: You have a real security-engineering foundation and you've owned a compliance program. You're not a spreadsheet-only GRC analyst, and you're not a strategy-only leader who won't get hands-on. ~5–8 years across security engineering and GRC is a good marker, but we care about the blend more than the number.
Fluent in the frameworks that matter to us: Direct experience with SOC 2 and hands-on familiarity with the CJIS Security Policy, NIST 800-53/800-171, or FedRAMP. Public-sector, GovCloud, or regulated-SaaS experience is a strong plus.
Comfortable in the cloud and in code: You can harden a cloud environment (Azure ideally), reason about IAM, encryption, network isolation, and logging, and automate controls and evidence with scripting and GRC tooling.
Credible in the room: You can face an auditor, a state CJIS Systems Officer, or a county CISO team and answer hard questions clearly — and translate the same material for our sales and implementation teams and our engineers.
High ownership, low ceremony: You see the gap, define the right thing to build, and drive it to done. You'd rather build a durable system than win an argument, and you're energized by being the person the whole company relies on for this.
Work authorization & CJIS eligibility: You must be authorized to work in the US without visa sponsorship, and — because of the data we handle — able to pass a state and national fingerprint-based background check for CJIS clearance.

To learn more about what it's like to work at Aurelian, visit our About Us page and follow us on LinkedIn to stay up to date!

We encourage you to apply even if you don’t meet every qualification listed above. We believe exceptional people come from many different backgrounds, and we’d rather connect with you than miss the opportunity.

Come do the best work of your life and join us in shaping the future of critical technology that truly matters.

For Full-Time roles, Aurelian offers a variety of benefits, including: