The opportunity
Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them.
What you'll do
Define the control framework and requirements for autonomous AI operators in: collaboration with Security, Internal Audit, and Engineering, including change review and approvals, human-in-the-loop, and evidence collection. Assess implementations against those requirements.
Pressure-test major infrastructure, system, and agent framework changes for: control impact during design, before decisions become expensive rework.
Set the compliance bar for home-built systems. Collaborate with teams to: define what the internal system must provide from day one, such as auditability, segregation of duties, and change control over the tool itself.
Define the criteria for where and when AI can operate, supplement, or replace: a manual process or control, including the human-in-the-loop thresholds and evidence documentation.
Establish the validation, evidence, and governance standards that allow: AI-performed and AI-assisted processes and controls to withstand external audit and regulatory scrutiny.
Assess the introduction of new compliance frameworks and changes in scope: (new regulations, certifications, products, or entities), providing a sufficient technical and compliance lens on their impact to control design, evidence requirements, and engineering effort before commitments are made.
What they're looking for
- Have a combination of audit or advisory experience (Big 4 or equivalent) with: in-house experience at an AI-forward tech company — in either order
- Have defined or assessed controls for AI/ML systems or agents acting in production environments
- Have stood up continuous controls monitoring or automated evidence programs
