Anthropic's mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole.
About the team
Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments.
About the role
As part of the Security Audit & Controls team, you will own the CCF across every control domain, from access and change management to logging, encryption, and people controls.
This is an individual contributor role for someone who works well independently, writes clearly, and gets satisfaction from a control set that is accurate, tested, and trusted by auditors and engineers alike.
Key responsibilities
Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding, retiring, or rewording controls.
Draft and validate control descriptions and control activities with control owners.
Design and run continuous monitoring of control efficacy.
Verify remediation and carry it into steady state.
Map new frameworks and commitments onto the CCF.
Support the integrated audit and customer audits.
Evaluate evidence reliability.
Build with Claude: automate control mapping, evidence testing, and monitoring.
Minimum qualifications
Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or control library across more than one framework (for example SOC 2, ISO 27001, FedRAMP, HIPAA).
Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability.
Experience writing control descriptions, control activities, and test procedures.
Experience with continuous controls monitoring or automated evidence collection.
Enough technical fluency to read a runbook, a configuration, or a pipeline definition.
Clear writing.
Ability to get control owners and partner teams to prioritize and close work without having authority over them.
Preferred qualifications
Have designed or rebuilt a common controls framework and led the remapping of existing frameworks onto it.
Have stood up continuous controls monitoring or automated evidence programs.
Have applied LLMs to assurance work.
Have defined or assessed controls for AI systems or agents operating in production.