Audit, Security GRC

Details

Anthropic's Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into security controls and provides leadership with visibility into control performance. The Audit & Assurance function runs integrated audits across the company's security frameworks and maintains the Common Control Framework.

This role supports Anthropic's unified audit program, including quarterly audits across SOC 2, HIPAA, the ISO 27000 family, ISO 42001, and other certifications. The role also plans new audits and framework expansions, performs gap assessments, improves audit operations, and drives automation for evidence collection and reporting. Building with Claude is a normal part of the job, with appropriate human judgment remaining in the loop.

Responsibilities

• Run the integrated audit program, including plans, calendars, milestones, dependencies, risks, decisions, and status reporting.
• Plan and run quarterly audits from scoping through report issuance and findings closeout.
• Lead audit readiness activities, including control owner preparation, evidence pre-checks, and walkthrough dry runs.
• Scope audit boundaries with Product and Engineering, including products and deployment paths in scope.
• Identify when launches or new platforms change audit scope.
• Build and maintain the audit operating model and runbook.
• Drive automation for evidence collection, request tracking, audit reporting, and reuse of evidence and walkthroughs across frameworks.
• Coordinate audits across frameworks and audit firms so audit windows align and control owners provide common evidence once.
• Work with GRC Engineering on automated evidence generation and collection.
• Plan new audits and audit expansions.
• Run framework and scope expansion evaluations and gap assessments, providing recommendations and effort estimates to leadership.
• Prepare control owners for audits, obtain evidence, close findings, and refer findings requiring extended remediation to GRC Partners.
• Manage day-to-day auditor relationships and report audit status, findings, and program metrics to GRC leadership.

Requirements

• Several years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and leadership status reporting.
• Several years of experience running external security audits, including SOC 2 and ISO 27001, with experience managing multiple frameworks concurrently.
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, HIPAA, and the overlap among their requirements.
• Experience leading a gap assessment for a new framework or scope change and presenting the results to leadership.
• Experience building or improving audit processes, including calendars, request tracking, runbooks, roles, and responsibilities.
• Technical fluency sufficient to understand how evidence is produced in cloud environments, assess whether system-generated reports are complete and accurate, and build simple automations with Claude.
• Clear writing and calm coordination under deadline pressure.
• Ability to obtain timely delivery from control owners without direct authority.
• A bachelor's degree or equivalent combination of education, training, and experience. The field of study must be relevant to the role through coursework, training, or professional experience.

Preferred Qualifications

• Experience at an audit firm, including Big Four firms or SOC 2 and ISO certification bodies, especially as a senior or manager serving technology clients.
• Experience adding frameworks such as PCI DSS, ISO 27701, ISO 27018, CSA STAR, IRAP, ISMAP, or C5.
• Experience automating evidence collection or audit reporting, or using Claude or other LLMs to plan, track, and report program work.
• Experience with a GRC platform or lightweight internal tooling.
• CISA, CISSP, ISO 27001 Lead Auditor, or similar certification is welcome but not required.
• Prior AI industry experience is not required.

Benefits

Anthropic offers competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and office space for collaboration. Staff are currently expected to work from one of Anthropic's offices at least 25% of the time, although some roles may require more in-office time.

Visa sponsorship is available, although successful sponsorship depends on the role and candidate. Anthropic retains an immigration lawyer to assist with the process.

Applications are accepted on a rolling basis with no stated deadline.