Security Risk & Compliance, SOX IT
About The Position
Anthropic’s Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into controls and provides leadership visibility into how well those commitments are being met. The team is building continuous assurance to evaluate and evidence control performance on an ongoing basis rather than relying only on periodic audits. As Anthropic scales toward public-company standards, this role is a hands-on senior contributor in the technical controls assurance function, focused on the IT general controls (ITGCs) that support SOX 404 compliance. The role defines control requirements, monitors whether controls operate, and ensures evidence is audit-ready before Internal Audit and external auditors test it. It works as a peer to Internal Audit’s IT SOX team, maintaining a clear distinction between management-side monitoring and independent testing. The role partners with Engineering, Security, IT, Finance, and GRC engineering to design and implement controls, validate that systems meet requirements, and automate evidence collection and continuous monitoring. It reports to the Head of Security Controls Assurance.
Requirements
- Senior-contributor experience with an ITGC program through SOX 404 readiness and/or at a public company.
- Working command of PCAOB AS 2201 and COSO 2013, including how external auditors scope, test, and evaluate technology controls and deficiencies.
- Hands-on IT audit or IT SOX experience designing, testing, and documenting controls across access management, change management, and operations.
- Engineering fluency sufficient to read code and Terraform, follow a CI/CD pipeline end to end, and assess technical designs.
- Deep familiarity with developer platforms, release engineering, cloud infrastructure, or ERP/financial systems control domains.
- Ability to collaborate and communicate across Finance, Engineering, Internal Audit, and external auditors; independently manage complex workstreams and keep senior stakeholders informed.
- Ability to translate SOX and framework requirements into engineering acceptance criteria and explain engineering realities in assurance language.
- Comfort working at the pace of a hypergrowth company, making decisions with incomplete information, and reprioritizing as scope shifts.
- Minimum education: bachelor’s degree or an equivalent combination of education, training, and/or experience.
- Required field of study: a field relevant to the role, demonstrated through coursework, training, or professional experience.
- Minimum years of experience are stated to correlate with the internal job level requirements.
Nice To Haves
- A combination of audit or advisory experience (Big 4 or equivalent, ideally IT audit) and in-house experience at an AI-forward technology company.
- 12 or more years of hands-on IT audit and SOX compliance experience.
- Experience taking a company through a first-year SOX 404(a) and 404(b) assessment, including a first external ITGC audit.
- Experience at a pre-IPO or newly public technology company.
- Experience defining or assessing controls over home-built financially significant systems, usage-based billing, or revenue metering pipelines.
- Experience defining or assessing controls for AI/ML systems or agents operating in production environments.
- Experience establishing continuous controls monitoring or automated evidence programs.
- Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls.
- Daily use of Claude and other LLMs, with specific views on which SOX assurance workflows AI can and cannot perform today.
Responsibilities
- Define control requirements and acceptance criteria across SOX ITGC domains, including logical access, change management, operations, and program development, for in-scope systems.
- Set requirements for financially significant systems before go-live, including home-built platforms, and assess SDLC controls for new implementations and system changes.
- Review major infrastructure, system, and agent framework changes for SOX impact, including changes to scope, key control populations, and evidence requirements.
- Perform second-line monitoring and readiness testing of key ITGCs and IT automated controls (ITACs), including walkthrough preparation and validation that populations are complete and accurate.
- Work with GRC engineering to automate evidence collection and monitoring, map controls to the common controls framework, increase automated evidence coverage, and reduce audit preparation time.
- Conduct system and process risk assessments, identify control gaps, and recommend actionable remediation.
- Track and investigate ITGC deficiencies, partner with engineering owners on remediation design, and assess whether remediation closes the gap before retesting.
- Support external audits with Finance and Internal Audit by preparing walkthroughs, evidence requests, and testing schedules.
- Assess the control design, evidence, and engineering implications of new products, entities, systems, and integrations entering SOX scope.
- Support controls and evidence related to SEC cybersecurity disclosure requirements.
Benefits
- Competitive compensation and benefits.
- Optional equity donation matching.
- Generous vacation and parental leave.
- Flexible working hours.
- Office space for collaboration.
- Visa sponsorship, with reasonable efforts to obtain a visa for candidates who receive an offer.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
