Third Party Risk Analyst, Security GRC

Details

Anthropic's Third Party Risk Management team within Security GRC manages risks associated with vendor and partner relationships. The role owns the Mission Critical and Highest-Risk vendor portfolios, covering compute, data center, data-pipeline, and vendors with extensive access to company data and systems. The program uses an AI risk agent for intake, tiering, and evidence collection.

Responsibilities

• Own the Mission Critical vendor portfolio, including tier maintenance, validation against business impact analysis findings, exit and failover planning, single-point-of-failure treatment, and coordination with Procurement, Business Continuity, and business owners.
• Manage the Highest-Risk vendor portfolio by aligning security, privacy, and compliance assessment depth with vendor exposure and driving remediation.
• Support vendor incident response, including vendor-side impact assessment, business-owner coordination, and post-incident risk treatment.
• Run inherent risk assessments through the intake workflow, review agent-prefilled tiering, evaluate vendor controls and evidence across security, privacy, compliance, and operational risk, determine residual risk, and route matters to domain reviewers when needed.
• Operate the TPRM issue management workflow by documenting findings with clear risk statements, assigning owners, tracking treatment to closure, and escalating stalled remediation.
• Tune and maintain the TPRM Risk Agent through prompt development, backtest calibration, error analysis, and output quality assurance.
• Contribute to KPI and KRI reporting on portfolio coverage and cycle time.

Requirements

• Experience running third-party or vendor risk assessments end to end at a technology company, including scoping engagements, determining inherent risk, reviewing controls and evidence, documenting residual risk, and driving findings to closure.
• Working knowledge of inherent and residual risk, control effectiveness, compensating controls, and risk acceptance.
• Ability to assess vendors across security, privacy, compliance, and operational risk domains and identify when domain-specialist review is required.
• Experience driving risk treatment to closure across teams with competing priorities.
• Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including prompt tuning and model-output accuracy review.
• Experience building or operating issue-management workflows with owners, due dates, remediation tracking, and escalation.
• Hands-on experience with a procurement or GRC platform and understanding of intake, tiering, and assessment routing.
• Knowledge of business continuity, disaster recovery, and concentration risk concepts.
• Preferred: experience assessing cloud infrastructure, data center, or data-pipeline vendors; vendor financial health or solvency screening using credit models, financial statements, RapidRatings, CreditSafe, or LSEG; SOX, SOC 2, or ISO 27001 vendor controls; and exit planning, contract termination provisions, or supplier failover testing.
• A bachelor's degree or equivalent combination of education, training, and experience is required.

Benefits

Anthropic offers competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and an office space for collaboration.