Security Risk & Compliance, SOX IT

Details

Anthropic's Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into actionable controls and provides leadership with visibility into security and control performance. As Anthropic scales to meet public-company standards, this role will serve as a hands-on senior contributor within the technical controls assurance function, focusing on IT general controls (ITGCs) and SOX 404 compliance across the technology stack.

The role will define control requirements, monitor control operation, ensure audit-ready evidence, and work closely with Engineering, Security, IT, Finance, GRC Engineering, Internal Audit, and external auditors. It will also help automate evidence collection and continuous monitoring for ITGCs and other security and compliance areas. The role reports to the Head of Security Controls Assurance.

Responsibilities

• Define control requirements and acceptance criteria across logical access, change management, operations, and program development for SOX in-scope systems, including internally developed platforms.
• Define control requirements for financially significant systems before go-live and assess SDLC controls for new system implementations and changes.
• Review infrastructure, system, and agent framework changes for SOX impact, including changes to SOX scope, key control populations, and evidence requirements.
• Perform second-line monitoring and readiness testing for key ITGCs and IT automated controls (ITACs), including walkthrough preparation and validation that populations are complete and accurate.
• Build continuous monitoring and audit evidence readiness with GRC Engineering by automating evidence collection, mapping controls to the common controls framework, and increasing automated evidence coverage.
• Conduct system and process risk assessments, identify control gaps, and recommend actionable remediation.
• Track and root-cause ITGC deficiencies identified through monitoring, Internal Audit, or external audit; partner with engineering owners on remediation and assess whether remediation closes the gap before retesting.
• Support external audits with Finance and Internal Audit by preparing walkthroughs, evidence requests, and testing schedules while maintaining the distinction between monitoring and independent testing.
• Assess the impact of new products, entities, systems, and integrations on control design, evidence requirements, and engineering effort.
• Support controls and evidence related to SEC cybersecurity disclosure requirements.

Requirements

• Senior-contributor experience with an ITGC program through SOX 404 readiness and/or at a public company.
• Working knowledge of PCAOB AS 2201, COSO 2013, and how external auditors scope, test, and evaluate technology controls and deficiencies.
• Hands-on IT audit or IT SOX experience designing, testing, and documenting controls across access management, change management, and operations.
• Engineering fluency, including the ability to read code and Terraform, follow a CI/CD pipeline end to end, and evaluate technical designs.
• Familiarity with developer platforms, release engineering, cloud infrastructure, or ERP and financial systems control domains.
• Strong collaboration and communication skills across Finance, Engineering, Internal Audit, and external auditors.
• Ability to work independently on complex workstreams while keeping senior stakeholders informed.
• Experience translating SOX and framework requirements into acceptance criteria for engineers and translating engineering realities into assurance language.
• Familiarity with Claude and other LLMs as working tools, including an understanding of which SOX assurance workflows AI can support.
• Bachelor's degree or an equivalent combination of education, training, and experience in a relevant field.

Strong candidates may also have:

• Big Four or equivalent audit/advisory experience combined with in-house experience at an AI-focused technology company.
• 12 or more years of hands-on IT audit and SOX compliance experience.
• Experience taking a company through a first-year SOX 404(a) and 404(b) assessment, including a first external ITGC audit.
• Experience at a pre-IPO or newly public technology company.
• Experience with controls over internally developed financially significant systems, usage-based billing, or revenue metering pipelines.
• Experience defining or assessing controls for AI/ML systems or production agents.
• Experience establishing continuous controls monitoring or automated evidence programs.
• Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls.

Benefits

Anthropic offers competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and office space for collaboration.