Security & Compliance Engineer

About Aurelian

Aurelian builds AI tools that help 911 centers handle more with less, so telecommunicators can stay focused on what matters most and communities get the response they need.

AVA is a conversational AI agent that answers non-emergency calls; the agent routes, triages, and resolves the calls without any human intervention. By handling administrative calls like noise complaints, lost dogs, and parking inquiries, AVA eliminates hold times and lets call-takers focus their energy on actual emergencies.

CORA supports call-takers on the calls that matter most. CORA is an on-screen assistant that delivers real-time SOP checklists, smart reminders, and contextual guidance as an emergency call unfolds, so dispatchers stay calm, consistent, and confident when every second counts. When AVA detects an emergency mid-call, it transfers the caller to a telecommunicator and passes along the caller details, location, incident type, and key statements directly into CORA.

The call-taker never starts from scratch.

The problem we're solving is serious. The average emergency communications center is 30% understaffed nationwide. Staffing shortages drive burnout and attrition, which makes the shortage worse. Meanwhile, 60-80% of the calls coming in aren't even emergencies elian addresses both sides of that equation: AVA reduces unnecessary call volume, and CORA makes every emergency call more manageable for the people handling it.

Aurelian is live in centers across the country, answering thousands of non-emergency calls every day, and is backed by New Enterprise Associates and Y Combinator. Aurelian is growing rapidly; we are hiring people who want to help scale this work and make a real difference in public safety infrastructure for communities across the country.

We handle criminal justice information for public-safety agencies. That means security and compliance aren't a back-office function at Aurelian - they're on the critical path of every deal we close and every center we go live in. Today that work is spread across our CTO and engineering leadership. We're hiring our first dedicated security and compliance owner to take it end-to-end - and to build it as a system we can scale.

This is a genuinely hybrid role: roughly half hands-on security engineering and half compliance program ownership. You'll harden the systems that handle 9-1-1 call data and own the SOC 2 and CJIS programs, the customer security questionnaires, and the artifacts that make our security posture legible to the agencies who trust us. If you want a seat where security work directly protects people in their worst moments — and where you get to define the function from the ground up — this is it.

• Own our security posture end-to-end: Be the single source of truth for how Aurelian handles sensitive data. Keep our security claims accurate, consistent, and defensible across every document, questionnaire, and contract.

• Run the compliance program: Own SOC 2 and our alignment to the CJIS Security Policy (and FedRAMP/Gov Cloud as our gov pipeline grows). Own the artifacts that don't fully exist yet - subprocessor lists, data management and retention policies, incident response plans - and keep them current.

• Turn security reviews from a bottleneck into a process: Own the customer security-questionnaire pipeline so deals don't wait on engineering. Work directly with our implementation and sales teams to get agencies the answers they need, quickly and accurately.

• Do the engineering, not just the paperwork: Harden our cloud infrastructure (Azure), tighten IAM and tenant isolation, improve logging/audit and detection, and shore up our secure development practices.

• Automate the compliance grind: Wire up and operate compliance-automation tooling so evidence collection, continuous controls monitoring, and questionnaire responses run as close to hands-off as possible. Treat compliance as code.

• Operationalize personnel security: Run the processes CJIS requires across engineering - background checks / fingerprinting, security-awareness training, and access controls for anyone who touches criminal justice information.