GSOC Response & Policy Program Specialist

Anthropic•San Francisco, CA

20h•$180,000 - $230,000•Hybrid

About The Position

Anthropic is seeking a GSOC Response & Policy Program Specialist to define how their Global Security Operations Center (GSOC) detects, responds to, and recovers from incidents affecting people, facilities, and operations. This role involves writing the GSOC plan and policy, including functions, severity matrix, communication templates, and service levels. The specialist will build global incident-specific response protocols, creating operator and business-facing playbooks, and design a scalable on-call rotation and call tree. This work will be taken through Legal, HR, and Communications for senior leadership signoff, followed by training and rollout. The position also assists in incident response, coordinating handoffs to Incident Commanders as incidents escalate, and serving as the liaison between GSOC and Crisis Management. The goal is to establish an approved, actionable standard for both the GSOC and the business, keeping it current as the program matures. This is a builder's role in a globally scaling program, covering on-site, off-site, and travel incidents, including natural disasters, across all Anthropic operating regions. Note: This role may involve exposure to graphic and disturbing content and requires on-call availability, including evenings, weekends, and holidays.

Requirements

8+ years of professional experience in GSOCs, security operations, emergency or crisis management, business continuity, incident command, or a closely related discipline
Hold a bachelor's degree or higher in a relevant field
Have authored security, safety, or emergency response policy that was formally approved and adopted by an organization
Served as Incident Commander, or in an equivalent command role, during live incidents
Working knowledge of ISO 22320:2018 (or an equivalent incident command system such as ICS/NIMS) and of severity or tiering frameworks, and can speak to adapting one to a specific organization
Write clearly and concisely for non-specialist audiences, and can tailor the same underlying content for an operator, a business partner, and an executive
Can manage a document-heavy program on a deadline while remaining available for live incident response
Strong drive for continuous process improvement and thrive in highly collaborative environments
Comfortable with a flexible schedule, including 24/7 on-call rotation and after-hours response

Nice To Haves

Experience standing up a security operations center or an incident response program from an undocumented state
Familiarity with mass notification, critical communications and incident management platforms
Experience with travel risk management and duty-of-care programs covering travelers and employees affected by natural disasters
Professional certifications such as CEM, CBCP, PSP, or FEMA ICS credentials
Specialized knowledge of risks unique to the AI sector

Responsibilities

Author the GSOC plan and policy, including the documented set of GSOC functions, the incident severity matrix, communication templates, and service level agreements for response timing
Design global incident- and event-specific response protocols, and produce the corresponding GSOC operator playbooks and business-facing playbooks
Define and obtain approval for the tooling and channels used for incident response and management, and for the distinct path used for information-only employee advisories
Partner with Legal, Communications, HR, and Employee Relations to align on notification thresholds and obligations before an incident occurs, not during one
Design and formalize a simple, scalable on-call rotation and call tree for GSOC incident response personnel, so Incident Commander coverage does not depend on any single person's availability
Drive policy socialization and secure approval from senior leadership
Build and deliver the training and rollout that puts the policy into practice
Assist in responding to incidents
Coordinate the handoff to the appropriate Incident Commander as an incident escalates
Act as the standing liaison between GSOC and Crisis Management, and partner with Crisis Management on GSOC service design
Run after-action reviews and tabletop exercises, and fold what they surface back into the policy
Measure whether the standard is being met, and report on it