Security Risk & Compliance, SOX IT

Anthropic•San Francisco, NY

16h•Hybrid

About The Position

Anthropic’s Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into actionable controls and provides leadership with visibility into how well the company meets those commitments. The team is building continuous assurance: challenging and evidencing control performance continuously rather than relying only on periodic audits. As Anthropic scales toward public-company standards, the SOX control environment over its technology stack is a consequential focus. Within Security GRC’s technical controls assurance function, this hands-on senior contributor defines what IT general controls must achieve to support SOX 404 compliance. The role works alongside Internal Audit’s IT SOX team, defining control requirements, monitoring control operation, and preparing audit-ready evidence before independent testing by Internal Audit and external auditors. The position partners with Engineering, Security, IT, and Finance to design and implement controls, and validates that delivered systems meet requirements. It also works with GRC Engineering to automate evidence collection and continuous monitoring, starting with ITGCs and extending to other security and compliance areas. The role reports to the Head of Security Controls Assurance.

Requirements

Senior-contributor experience with an ITGC program through SOX 404 readiness and/or at a public company.
Working command of PCAOB AS 2201 and COSO 2013, including how external auditors scope, test, and evaluate technology controls and deficiencies.
Hands-on IT audit or IT SOX experience designing, testing, and documenting controls across access management, change management, and operations.
Engineering fluency, including the ability to read code and Terraform, follow a CI/CD pipeline end to end, and assess technical designs.
Deep familiarity with developer platforms, release engineering, cloud infrastructure, or ERP/financial systems control domains.
Strong collaboration and communication skills across Finance, Engineering, Internal Audit, and external auditors; ability to independently manage complex workstreams and keep senior stakeholders informed.
Ability to work at a hypergrowth pace, make decisions with incomplete information, and reprioritize as scope changes.
Use Claude and other LLMs as daily work tools and have specific, grounded views on which SOX assurance workflows AI can and cannot perform today.
Ability to translate SOX and framework language into requirements engineers can implement and translate engineering realities into assurance language.
Bachelor’s degree or an equivalent combination of education, training, and/or experience.
Education or experience in a field relevant to the role.

Nice To Haves

A combination of audit or advisory experience, ideally IT audit at a Big 4 firm or equivalent, and in-house experience at an AI-forward technology company.
12 or more years of hands-on IT audit and SOX compliance experience.
Experience taking a company through its first-year SOX 404(a) and 404(b) assessment, including its first external ITGC audit.
Experience at a pre-IPO or newly public technology company.
Experience defining or assessing controls over home-built financially significant systems, usage-based billing, or revenue metering pipelines.
Experience defining or assessing controls for AI/ML systems or agents operating in production.
Experience establishing continuous controls monitoring or automated evidence programs.
Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls.

Responsibilities

Define control requirements and acceptance criteria across SOX ITGC domains, including logical access, change management, operations, and program development, for in-scope systems.
Set control requirements for financially significant systems before go-live, including home-built platforms, and assess SDLC controls for new implementations and changes.
Review major infrastructure, system, and agent framework changes for SOX impact, including changes to scope, key control populations, and evidence requirements.
Perform second-line monitoring and readiness testing of ITGCs and IT automated controls (ITACs), including preparing walkthroughs and validating population completeness and accuracy.
Work with GRC Engineering to automate evidence collection and monitoring, map controls to the common controls framework, increase automated evidence coverage, and reduce audit preparation time.
Conduct system and process risk assessments, identify control gaps, and recommend actionable remediation.
Track and root-cause ITGC deficiencies identified through monitoring or audits; partner with engineering owners on remediation and verify that fixes close gaps before retesting.
Support Finance and Internal Audit with external audit walkthroughs, evidence requests, and testing schedules while maintaining separation between management monitoring and Internal Audit’s independent testing.
Assess the control design, evidence requirements, and engineering effort associated with new products, entities, systems, and integrations entering SOX scope.
Support controls and evidence related to SEC cybersecurity disclosure requirements.
Translate SOX and framework requirements into engineering acceptance criteria and communicate engineering realities in assurance language for auditors and leadership.