Security Risk & Compliance, Agent Security

Anthropic•San Francisco, NY

7d•Hybrid

About The Position

Anthropic's Security Governance, Risk, and Compliance (GRC) team is responsible for ensuring the company adheres to its security commitments. This role involves translating regulatory, customer, and voluntary obligations into actionable controls and providing leadership with an overview of compliance status. The team is developing an innovative GRC approach that leverages AI, specifically Claude, to continuously monitor and evidence control performance, moving beyond traditional periodic audits.

Requirements

8+ years in security governance, risk, and compliance, with experience owning security policies and control standards at a technology company.
Experience owning or supporting efforts to compartmentalize sensitive data, PII, or intellectual property.
Understanding of how identity and access mechanisms implement or undermine protection boundaries.
Ability to conceptualize non-human identities as a distinct risk and control category.
Skill in designing least-privilege access and accountability controls for systems acting on behalf of a person.
Ability to reason from a threat model to a control and explain tradeoffs to both engineers and auditors.
Experience defining risk-based review or approval criteria within engineering workflows and maintaining their effectiveness under high change velocity.
Proficiency in delivering clear, precise written work for both technical and non-technical audiences.
Ability to thrive in ambiguous environments without a settled industry playbook, proposing standards rather than waiting for them.
A proactive approach to being a security and risk authority who educates and influences outcomes.

Nice To Haves

Understanding of the security properties of LLM agents, either from an AI, developer-platform, or agent-tooling company, or comparable experience.
Familiarity with AI governance frameworks alongside traditional security frameworks.
Experience adapting controls from regulated or highly sensitive environments to an open, high-trust engineering culture.
Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor.

Responsibilities

Serve as the security policy partner for AI agent governance, authoring policies and standards for agent development, deployment, and operation.
Define review and approval criteria for agents interacting with sensitive or regulated data, and determine actions requiring human approval in relation to compliance frameworks.
Act as the GRC reviewer within existing engineering approval workflows.
Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data.
Monitor agent behavior over time and adapt governance requirements in collaboration with cross-functional security, research, and engineering teams.
Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act) to support Anthropic's certification efforts and ensure agent security is auditable.
Assess and document agent-related security and compliance risks, and drive their resolution with engineering owners.
Own the policy for agent-related risk acceptances and exceptions, including defining approval authority, duration, and re-review processes.