Most things that happen to issues fire an "event". JIRA uses these internally for some things (most notably the email notifications).
As you've already noticed, post-functions only work on workflows and there's not really a hook for non-workflow actions. But the actions still fire events, and you can write listeners to catch events and act upon them.
So, you need to find or write a listener that will listen for the "issue assigned" event, run your business logic to determine what to set the security level to, and set it.
I'd use the script runner to do this, but you might want to have a look through the marketplace for other options too.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.