Staff / Senior Data Center Security Engineer

Anthropic•San Francisco, CA

7d•Hybrid

About The Position

Anthropic is hiring a foundational security engineer to secure its data center footprint, including sites operated by Anthropic and its partners, hardware moving through those sites, and the people and vendors involved. The engineer will own one or more security domains end to end: designing controls, building systems that enforce and verify them, and establishing technical standards for the team and partners. The role emphasizes simple, verifiable controls; requirements maintained as code; continuously verified evidence, chain of custody, and access; and automation and AI agents that replace manual reviews. Anthropic uses Claude throughout its engineering workflow and expects the hire to do so as well. The role works with DCSE, compute, data center operations, legal, compliance, and procurement teams, as well as data center operators, hardware vendors, and logistics providers. It includes regular travel to data center sites, which are critical infrastructure, and may include on-call work for security events. The position focuses on engineering controls around physical security systems and across domains such as hardware custody, media, personnel, and vendors.

Requirements

Have engineered a security control domain end to end by designing controls, building or integrating systems that enforce them, and verifying that they work.
Be able to read and review code, design data systems behind security tooling, and build automation, often using AI coding agents, Git, and code review.
Have hands-on security experience for data centers, critical infrastructure, or a large hardware fleet in at least one of the listed security domains.
Have applied a control framework such as NIST SP 800-53, ISO 27001, or SOC 2 to real systems and produced evidence for it.
Be able to write requirements that a third party can implement and an assessor can test, specifying what must be true, how it is verified, and what evidence demonstrates it.
Minimum education: bachelor's degree or an equivalent combination of education, training, and/or experience.
Required field of study: a field relevant to the role, demonstrated through coursework, training, or professional experience.

Nice To Haves

Experience across several of the listed security domains rather than only one.
Experience at sites not fully controlled by the employer, such as cloud, colocation, or GPU cloud operators.
Experience with federal assessment regimes based on NIST SP 800-53, including supply chain (NIST SP 800-161) and media sanitization (NIST SP 800-88) guidance, and producing evidence accepted by an assessor.
Experience building governance, risk, and compliance (GRC) or evidence automation, including automated control checks, asset or custody tracking, questionnaire and assessment pipelines, or docs-as-code workflows.
Experience running incident response at physical sites, including alarms, investigations, and after-action fixes.
Experience working in live data halls and on active construction sites, and ability to follow a method of procedure.
Experience redlining contract security language with legal and procurement counterparts.
Experience with international sites, including per-country personnel screening and staffing restrictions, data residency, and export controls on hardware.
Experience building AI agents or automation that replaced recurring manual security work.

Responsibilities

Own one or more security domains, including physical security at partner- and Anthropic-operated sites, hardware supply chain and chain of custody, media protection and sanitization, personnel security and site access, third-party and vendor security assessment, and maintenance and contingency controls.
Build internal tools, automation, and AI agents for evidence collection, access reviews, asset and custody tracking, and partner intake; replace recurring manual work with tools.
Review security for new sites, leases, and vendors; identify gaps in designs, contracts, and operator procedures; write security terms and exhibits; and verify fixes after signing.
Write requirements and procedures that partners can implement and assessors can test, maintaining them as code in a version-controlled repository.
Assess sites and suppliers against requirements using on-site reviews and evidence; document deviations and engineer compensating controls where requirements cannot be met as written.
Connect controls to compliance frameworks and maintain current evidence that can be used directly in assessments.
Respond to site security events, including intrusion alarms, custody breaks, and access violations, with operations teams and site operators; document events and fix the controls that allowed them.
Travel regularly to data center sites and potentially participate in on-call coverage for security events.