Security & Compliance Engineer

Aurelian builds AI tools that help 911 centers handle more with less, so telecommunicators can stay focused on what matters most and communities get the response they need.

AVA is a conversational AI agent that answers non-emergency calls; the agent routes, triages, and resolves the calls without any human intervention. By handling administrative calls like noise complaints, lost dogs, and parking inquiries, AVA eliminates hold times and lets call-takers focus their energy on actual emergencies.

CORA supports call-takers on the calls that matter most. CORA is an on-screen assistant that delivers real-time SOP checklists, smart reminders, and contextual guidance as an emergency call unfolds, so dispatchers stay calm, consistent, and confident when every second counts. When AVA detects an emergency mid-call, it transfers the caller to a telecommunicator and passes along the caller details, location, incident type, and key statements directly into CORA. The call-taker never starts from scratch.

The problem we're solving is serious. The average emergency communications center is 30% understaffed nationwide. Staffing shortages drive burnout and attrition, which makes the shortage worse. Meanwhile, 60-80% of the calls coming in aren't even emergencies at all. Aurelian addresses both sides of that equation: AVA reduces unnecessary call volume, and CORA makes every emergency call more manageable for the people handling it.

• →

  Own our security posture end-to-end: Be the single source of truth for how Aurelian handles sensitive data. Keep our security claims accurate, consistent, and defensible across every document, questionnaire, and contract.

• →

  Run the compliance program: Own SOC 2 and our alignment to the CJIS Security Policy (and FedRAMP/GovCloud as our gov pipeline grows). Own the artifacts that don't fully exist yet - subprocessor lists, data management and retention policies, incident response plans - and keep them current.

• →

  Turn security reviews from a bottleneck into a process: Own the customer security-questionnaire pipeline so deals don't wait on engineering. Work directly with our implementation and sales teams to get agencies the answers they need, quickly and accurately.

• →

  Do the engineering, not just the paperwork: Harden our cloud infrastructure (Azure), tighten IAM and tenant isolation, improve logging/audit and detection, and shore up our secure development practices.

• →

  Automate the compliance grind: Wire up and operate compliance-automation tooling so evidence collection, continuous controls monitoring, and questionnaire responses run as close to hands-off as possible. Treat compliance as code.

• →

  Operationalize personnel security: Run the processes CJIS requires across engineering - background checks / fingerprinting, security-awareness training, and access controls for anyone who touches criminal justice information.

• A builder who can also run the program: You have a real security-engineering foundation and you've owned a compliance program. You're not a spreadsheet-only GRC analyst, and you're not a strategy-only leader who won't get hands-on. ~5–8 years across security engineering and GRC is a good marker, but we care about the blend more than the number.

• Fluent in the frameworks that matter to us: Direct experience with SOC 2 and hands-on familiarity with the CJIS Security Policy, NIST 800-53/800-171, or FedRAMP. Public-sector, GovCloud, or regulated-SaaS experience is a strong plus.

• Comfortable in the cloud and in code: You can harden a cloud environment (Azure ideally), reason about IAM, encryption, network isolation, and logging, and automate controls and evidence with scripting and GRC tooling.

• Credible in the room: You can face an auditor, a state CJIS Systems Officer, or a county CISO team and answer hard questions clearly — and translate the same material for our sales and implementation teams and our engineers.

• High ownership, low ceremony: You see the gap, define the right thing to build, and drive it to done. You'd rather build a durable system than win an argument, and you're energized by being the person the whole company relies on for this.

• Work authorization & CJIS eligibility: You must be authorized to work in the US without visa sponsorship, and — because of the data we handle — able to pass a state and national fingerprint-based background check for CJIS clearance.

To learn more about what it's like to work at Aurelian, visit our About Us page and follow us on LinkedIn to stay up to date!

We encourage you to apply even if you don’t meet every qualification listed above. We believe exceptional people come from many different backgrounds, and we’d rather connect with you than miss the opportunity.

Come do the best work of your life and join us in shaping the future of critical technology that truly matters.