Audit, Security GRC

Anthropic•San Francisco, NY

3d•Hybrid

About The Position

Anthropic is hiring an individual contributor for its Security Governance, Risk, and Compliance (GRC) team, within Audit & Assurance. The role helps operate Anthropic’s integrated audit program and maintain and expand the program as the company adds frameworks, platforms, and regions. The person will coordinate quarterly audits across SOC 2, HIPAA, the ISO 27000 family—including ISO 42001—and other certifications, working with audit firms, GRC Partners, and control owners across the company. The role includes planning and running audits from scoping through reporting and findings closeout; preparing control owners and evidence before fieldwork; and assessing how product launches, platforms, and deployment paths affect audit scope. It also involves evaluating new frameworks and scope expansions through gap assessments and effort estimates, helping build and maintain the program’s operating model and runbook, and improving automation so evidence and walkthroughs can be reused across frameworks. Building with Claude is part of the work, with human judgment kept in the loop where appropriate. The position is suited to someone with program management experience who writes clearly, coordinates calmly under deadlines, and can simplify a complex, busy program. Anthropic currently expects staff to work from one of its offices at least 25% of the time, though some roles may require more.

Requirements

Several years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and leadership status reporting.
Several years running external security audits, including SOC 2 and ISO 27001 at minimum, either on the company side or at an audit firm; experience with multiple frameworks running concurrently.
Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and HIPAA, including areas where their requirements overlap.
Experience leading a gap assessment for a new framework or scope change and presenting the results to leadership.
Experience building or improving audit processes, including calendars, request tracking, runbooks, and roles and responsibilities.
Technical fluency sufficient to understand how evidence is produced in cloud environments, assess whether system-generated reports are complete and accurate, and build simple automations with Claude.
Clear writing and calm coordination under deadline pressure.
Ability to get control owners to deliver on time without having authority over them.
A bachelor's degree or an equivalent combination of education, training, and/or experience.
A field of study relevant to the role, demonstrated through coursework, training, or professional experience.

Nice To Haves

Audit firm experience, such as Big 4 or a SOC 2 or ISO certification body, especially as a senior or manager on technology clients.
Experience adding frameworks such as PCI DSS, ISO 27701 or ISO 27018, CSA STAR, or international schemes such as IRAP, ISMAP, or C5.
Experience automating evidence collection or audit reporting, or using Claude or other LLMs day to day to plan, track, and report program work.
Experience with a GRC platform or building lightweight internal tooling.
Certifications such as CISA, CISSP, or ISO 27001 Lead Auditor; these are welcome but not required.
Prior AI industry experience is welcome but not required.

Responsibilities

Run an integrated audit program plan and calendar across audits and expansions, tracking milestones, dependencies, risks, and decisions, and provide regular status updates to GRC leadership and stakeholders.
Plan and run quarterly audits from scoping through reporting and findings closeout.
Prepare for audit fieldwork by coordinating control-owner preparation, evidence pre-checks, and walkthrough dry runs.
Scope audit boundaries with Product and Engineering, including products and deployment paths, and flag changes caused by launches or new platforms.
Help build and maintain the operating model and runbook for a unified audit program.
Drive automation for evidence collection from source systems, request tracking, and audit reporting, including reuse of evidence and walkthroughs across frameworks.
Coordinate audits across frameworks and firms to align audit windows and avoid duplicate evidence requests to control owners.
Work with GRC Engineering on automated evidence generation and collection.
Plan new audits and audit expansions as the company commits to them.
Run framework and scope expansion evaluations and gap assessments, and provide leadership with recommendations and effort estimates.
Work with control owners and GRC Partners to prepare for audits, deliver evidence, close findings, and route findings needing extended remediation to GRC Partners.
Manage day-to-day auditor relationships and report audit status, findings, and program metrics to GRC leadership.