About the company
Anthropic's mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole.
About the team
Anthropic's Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into controls that teams act on.
Responsibilities
- Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated
- Define review and approval criteria when an agent may interact with sensitive or regulated data
- Serve as the GRC reviewer within existing engineering approval workflows
- Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data
- Monitor agent behavior over time and adapt governance requirements
- Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act)
- Assess and document agent-related security and compliance risks
- Own the policy for agent-related risk acceptances and exceptions
Requirements
- 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
- Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property
- Think about non-human identities as a distinct risk and control category
- Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor
- Have defined risk-based review or approval criteria within engineering workflows
- Deliver clear, precise written work for both technical and non-technical audiences
- Thrive in ambiguous environments with no settled industry playbook
Preferred
- Understand the security properties of LLM agents
- Bring familiarity with AI governance frameworks alongside traditional security frameworks
- Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor)
Conditions
- Annual Salary: $255,000 — $345,000 USD
- Location-based hybrid policy: expect all staff to be in one of our offices at least 25% of the time
- Visa sponsorship available