The opportunity
Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them.
What you'll do
Run the audit program as a program: one integrated plan and calendar across audits and expansions, with milestones, dependencies, risks and decisions tracked, and regular status to GRC leadership and stakeholders
Plan and run the quarterly audits, from scoping through report and findings closeout
Run audit readiness ahead of each fieldwork window: control owner prep, evidence pre-checks and walkthrough dry runs
Scope each audit's boundary with Product and Engineering: which products and deployment paths are in scope, and flag when a launch or new platform changes it
Help build the audit operating model and runbook for a unified audit program,: and keep both current as the program grows
Drive automation in the program: evidence collected from source systems, request tracking and audit reporting, with evidence and walkthroughs reused across frameworks
What they're looking for
- Audit firm experience (Big 4 or a SOC 2 or ISO certification body),: especially as a senior or manager on technology clients
- Experience adding new frameworks such as PCI DSS, ISO 27701 or 27018, CSA: STAR, or international schemes (for example IRAP, ISMAP or C5)
- Have automated evidence collection or audit reporting, or use Claude or other: LLMs day to day to plan, track and report program work
- Experience with a GRC platform or building lightweight internal tooling
