Audit, Security GRC

Anthropic • Washington, DC

4d • $255,000 - $270,000 • Hybrid

About The Position

Anthropic’s Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary security obligations into controls and gives leadership visibility into how well those obligations are being met. The Audit & Assurance group runs integrated audits across the company’s frameworks and maintains the Common Control Framework. This individual contributor role supports and improves Anthropic’s unified audit program.

The role runs quarterly audits across SOC 2, HIPAA, the ISO 27000 family—including ISO 42001—and other certifications, in collaboration with audit firms, GRC Partners, and control owners. It also plans audits as the company expands into new frameworks, platforms, and regions, and conducts framework and scope gap assessments to estimate the effort involved before expansion decisions are made.

The person in this role will help develop and maintain the audit operating model and runbook, and drive automation so evidence can be collected once and reused across frameworks, requests are coordinated efficiently, and audit cycles require less effort over time. Building with Claude is a normal part of the role, with human judgment retained where appropriate. The role calls for program management experience, clear writing, calm coordination under deadlines, and an interest in simplifying complex programs.

Requirements

• Several years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and leadership status reporting.
• Several years of experience running external security audits, including SOC 2 and ISO 27001 at minimum, either on the company side or at an audit firm, including periods with multiple frameworks running concurrently.
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and HIPAA, including areas where their requirements overlap.
• Experience leading a gap assessment for a new framework or scope change and presenting the results to leadership.
• Experience building or improving an audit process, including calendars, request tracking, runbooks, and roles and responsibilities.
• Technical fluency sufficient to understand how cloud-environment evidence is produced and assess whether system-generated reports are complete and accurate, and to build simple automations with Claude.
• Clear writing and calm coordination under deadline pressure.
• Ability to get control owners to deliver on time without having authority over them.
• Bachelor’s degree or an equivalent combination of education, training, and/or experience.
• A field of study relevant to the role, demonstrated through coursework, training, or professional experience.

Nice To Haves

• Audit firm experience, such as Big 4 or a SOC 2 or ISO certification body, especially as a senior or manager serving technology clients.
• Experience adding frameworks such as PCI DSS, ISO 27701, ISO 27018, CSA STAR, or international schemes such as IRAP, ISMAP, or C5.
• Experience automating evidence collection or audit reporting, or using Claude or other LLMs day to day to plan, track, and report program work.
• Experience with a GRC platform or building lightweight internal tooling.
• Certifications such as CISA, CISSP, or ISO 27001 Lead Auditor; these are welcome but not required.
• Prior AI industry experience is not required.

Responsibilities

• Manage an integrated audit plan and calendar across audits and expansions, tracking milestones, dependencies, risks, and decisions, and providing regular status updates to GRC leadership and stakeholders.
• Plan and run quarterly audits from scoping through report delivery and findings closeout.
• Prepare for audit fieldwork by coordinating control-owner preparation, evidence pre-checks, and walkthrough dry runs.
• Scope audit boundaries with Product and Engineering, including products and deployment paths, and flag launches or new platforms that may change the scope.
• Build and maintain the operating model and runbook for the unified audit program.
• Drive automation for evidence collection from source systems, request tracking, and audit reporting, reusing evidence and walkthroughs across frameworks.
• Coordinate audits across frameworks and audit firms so audit windows align and control owners provide common evidence once.
• Work with GRC Engineering on automated evidence generation and collection.
• Plan new audits and audit expansions as the company commits to them.
• Conduct framework and scope expansion evaluations and gap assessments, providing leadership with actionable recommendations and effort estimates.
• Work with control owners and GRC Partners to prepare for audits, deliver evidence, close findings, and route findings requiring extended remediation to GRC Partners.
• Manage day-to-day auditor relationships and report audit status, findings, and program metrics to GRC leadership.

Benefits

• Competitive compensation and benefits.
• Optional equity donation matching.
• Generous vacation and parental leave.
• Flexible working hours.
• Office space for collaborating with colleagues.
• Visa sponsorship, with reasonable efforts to obtain a visa for candidates who receive an offer.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level