Staff / Senior Data Center Security Engineer

Anthropic•San Francisco, CA

18h•$320,000 - $405,000•Hybrid

About The Position

Anthropic is hiring a Staff / Senior Data Center Security Engineer to secure the data centers where Claude is trained and served, including Anthropic-operated sites and partner-operated facilities. The engineer will own one or more security domains end to end: designing controls, building systems that enforce and verify them, and setting technical standards for the team and its partners. The work emphasizes automated, verifiable security, including requirements maintained as code, continuous verification of evidence, chain of custody and access, and tools or agents that replace manual reviews. This is a foundational role that will help shape and scale Anthropic's security engineering. Unlike physical security systems engineers, who design and test site security systems, this role engineers the controls around those systems and across other domains, including hardware custody, media, personnel and vendors. The engineer will work with DCSE, compute, data center operations, legal, compliance and procurement teams, as well as data center operators, hardware vendors and logistics providers. The role involves regular travel to data center sites, which are critical infrastructure, and may include on-call responsibility for security events. The position requires at least a bachelor's degree or an equivalent combination of education, training and/or experience, in a field relevant to the role as demonstrated through coursework, training or professional experience. Required years of experience will correlate with the internal job level. Anthropic currently expects staff to work in one of its offices at least 25% of the time, though some roles may require more office time. Visa sponsorship is available, subject to role and candidate circumstances.

Requirements

Have engineered a security control domain end to end, including designing controls, building or integrating enforcement systems, and verifying that they work.
Be able to read and review code, design data systems behind security tooling, and build automation, often with AI coding agents, using Git and code review.
Have hands-on security experience for data centers, critical infrastructure or a large hardware fleet in at least one domain listed under the responsibilities.
Have applied a control framework such as NIST SP 800-53, ISO 27001 or SOC 2 to real systems and produced evidence for it.
Be able to write requirements a third party can build to and an assessor can test, specifying what must be true, how it is verified and what evidence demonstrates it.
Bachelor's degree or equivalent combination of education, training and/or experience; the field must be relevant to the role as demonstrated through coursework, training or professional experience.
Years of experience required correlate with the internal job level requirements for the position.

Nice To Haves

Experience across several of the security domains listed in the responsibilities rather than just one.
Experience at sites not fully controlled by the employer, such as cloud, colocation or GPU cloud operator sites.
Experience with federal assessment regimes based on NIST SP 800-53, including supply chain (NIST SP 800-161) and media sanitization (NIST SP 800-88) guidance, and producing evidence accepted by an assessor.
Experience building governance, risk and compliance (GRC) or evidence automation, including automated control checks, asset or custody tracking, questionnaire and assessment pipelines, or docs-as-code workflows.
Experience running incident response at physical sites, including alarms, investigations and after-action fixes.
Experience working in live data halls and on active construction sites, and following a method of procedure.
Experience redlining contract security language with legal and procurement counterparts.
Experience with international sites, including per-country personnel screening and staffing restrictions, data residency, and hardware export controls.
Experience building AI agents or automation that replaced recurring manual security work.

Responsibilities

Own one or more security domains end to end, including physical security at partner-operated and Anthropic-operated sites, hardware supply chain and chain of custody, media protection and sanitization, personnel security and site access, third-party and vendor security assessment, and maintenance and contingency controls.
Build internal tools, automation and AI agents for evidence collection, access reviews, asset and custody tracking, and partner intake; replace recurring manual processes with tools where appropriate.
Review security for new sites, leases and vendors; identify gaps in designs, contracts and operator procedures, write security terms and exhibits, and verify remediation after signing.
Write requirements and procedures that partners can implement and assessors can test, and maintain them as code in a version-controlled repository.
Assess sites and suppliers against requirements, both on site and through evidence; document deviations and engineer compensating controls when requirements cannot be met as written.
Connect controls to applicable compliance frameworks and maintain current evidence so it can be used directly in assessments.
Respond to site security events, including intrusion alarms, custody breaks and access violations, in coordination with operations teams and site operators; document incidents and correct the controls that allowed them.