Platform Security Engineering, Auditor

Details

Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. The Platform Security Engineering, Auditor role focuses on hands-on vulnerability assessment for platform security: auditing hardware, firmware, bootloaders, operating systems, and attestation systems to identify and eliminate vulnerabilities. The role requires ownership to ensure findings are fully remediated in production and never reintroduced.

Responsibilities

• Audit secure boot chains from firmware through OS initialization for diverse hardware platforms (CPUs, BMCs, switches, peripherals, and embedded microcontrollers)
• Audit attestation systems that provide cryptographic proof of system state from hardware root of trust through application layer
• Audit measured boot implementations and runtime integrity monitoring
• Integrate security controls with infrastructure teams without impacting training performance
• Validate security mechanisms before production deployment
• Conduct firmware vulnerability assessments and penetration testing
• Build firmware vulnerability assessment pipelines for continuous security monitoring
• Document security architectures and maintain threat models
• Collaborate with software and hardware vendors to ensure security capabilities meet requirements for exploit mitigation

Requirements

• Proven track record of conducting hands-on vulnerability auditing on complex, security-critical systems
• Hands-on experience with secure boot, measured boot, and attestation technologies (TPM, Intel TXT, AMD SEV, ARM TrustZone)
• Strong understanding of cryptographic protocols and hardware security modules (HSMs)
• Experience with UEFI/BIOS or embedded firmware security, bootloader hardening, and chain of trust implementation
• Proficiency in low-level programming languages (C, Assembly) and systems programming
• Knowledge of firmware vulnerability assessment and threat modeling
• Ability to work effectively across hardware and software boundaries
• Strong communication and cross-functional collaboration skills
• Track record of assessing security architectures for complex, distributed systems

Preferred Qualifications

• 8+ years of experience in systems security, with at least 5 years focused on low-level security (firmware, bootloaders, and OS kernel-level security)
• Capacity to audit for logic bugs in code written in Rust or Go
• Ability to find vulnerabilities via reverse engineering in software provided only in binary form
• Experience performing fault injection & side-channel analysis attacks on hardware
• Experience auditing silicon root of trust implementations
• Experience auditing confidential computing technologies and hardware-based TEEs
• Background in formal verification or security proof techniques
• 5 or more talks at top-tier security conferences with candidate listed as first author
• Experience using LLMs to automate security assessment (including tooling creation)
• Experience securing large-scale HPC or cloud infrastructure
• Previous work with AI/ML infrastructure security

Compensation

• Annual Salary: $320,000 - $405,000 USD

Logistics

• Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience
• Required field of study: a field relevant to the role as demonstrated through coursework, training, or professional experience
• Minimum years of experience: will correlate with internal job level requirements
• Location-based hybrid policy: staff are expected to be in one of Anthropic’s offices at least 25% of the time (some roles may require more time on-site)
• Office locations listed: San Francisco, CA; New York City, NY; Seattle, WA
• Visa sponsorship: Anthropic states they sponsor visas and will make reasonable efforts to obtain a visa for offers, and retain an immigration lawyer to assist

How to Apply

Application materials requested include resume/CV or LinkedIn profile. The posting encourages applicants to apply even if they do not meet every qualification and provides guidance on safe recruiter communication.