The opportunity
Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them.
What you'll do
Serve as the security policy partner for AI agent governance, authoring the: policies and standards for how agents are built, deployed, operated
Define review and approval criteria when an agent may interact with sensitive: or regulated data, and which actions require human approval as it relates to compliance frameworks
Serve as the GRC reviewer within existing engineering approval workflows
Define data governance requirements for agents, including least-privilege: access, access reviews, and handling of regulated and sensitive data
Monitor agent behavior over time and adapt governance requirements in: partnership with cross-functional security, research and engineering teams
Map agent security and data controls to AI governance frameworks (e.g., ISO: 27001, ISO 42001, EU AI Act), strengthening Anthropic's certification efforts ensuring agent security is auditable
What they're looking for
- Assess and document agent-related security and compliance risks, driving them: to resolution with engineering owners
- Own the policy for agent-related risk acceptances and exceptions, including: approval authority, duration and re-review
- Have 8+ years in security governance, risk, and compliance, including: ownership of security policies and control standards at a technology company
- Have owned or meaningfully supported efforts to compartmentalize sensitive: data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries
