Audit, Security GRC (AI)

Location: San Francisco, CA; Seattle, WA; New York City, NY; or Washington, DC. Hybrid policy: staff are expected to work from one of the offices at least 25% of the time, and some roles may require more office time.

Annual salary: $255,000–$270,000 USD.

Company

Anthropic builds reliable, interpretable, and steerable AI systems intended to be safe and beneficial for users and society.

What you will do

• Run an integrated audit program and calendar covering quarterly SOC 2, HIPAA, ISO 27000 family, ISO 42001, and other certification audits.
• Plan and execute audits from scoping through reporting and findings closeout, including readiness activities, evidence pre-checks, and walkthrough dry runs.
• Define audit boundaries with Product and Engineering, assess new frameworks, platforms, regions, and scope changes, and lead gap assessments with recommendations and effort estimates.
• Build and maintain the audit operating model, runbook, milestones, dependencies, risks, decisions, and program metrics.
• Drive automation for evidence collection, request tracking, audit reporting, and reuse of evidence and walkthroughs across frameworks, including automation with Claude and GRC Engineering.
• Coordinate audit firms, GRC Partners, control owners, and GRC leadership; manage auditor relationships and drive evidence delivery and findings remediation.

Requirements

• Several years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and leadership status reporting.
• Several years of experience running external security audits, including SOC 2 and ISO 27001 at minimum, with experience handling multiple frameworks during the same audit season.
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, HIPAA, and the overlap between their requirements.
• Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership.
• Experience building or improving audit processes, including calendars, request tracking, runbooks, roles, and responsibilities.
• Technical fluency sufficient to understand how evidence is produced in cloud environments, assess whether system-generated reports are complete and accurate, and build simple automations with Claude.
• Clear writing, calm coordination under deadline pressure, and the ability to get control owners to deliver on time without direct authority.
• Bachelor’s degree or an equivalent combination of education, training, and experience; the field of study must be relevant to the role through coursework, training, or professional experience.

Nice to have

• Audit firm experience, including Big Four or SOC 2/ISO certification body experience, especially as a senior or manager serving technology clients.
• Experience adding frameworks such as PCI DSS, ISO 27701, ISO 27018, CSA STAR, IRAP, ISMAP, or C5.
• Experience automating evidence collection or audit reporting, or using Claude or other LLMs to plan, track, and report program work.
• Experience with a GRC platform or lightweight internal tooling.
• CISA, CISSP, ISO 27001 Lead Auditor, or a similar certification.
• Prior AI industry experience is not required.

Culture & Benefits

• Collaborative environment focused on building safe, trustworthy, and beneficial AI systems.
• Flexible working hours and an office environment for collaboration.
• Competitive compensation, optional equity donation matching, generous vacation, and parental leave.
• Visa sponsorship may be available; Anthropic makes reasonable efforts to support visas and works with an immigration lawyer.
• Applications are accepted on a rolling basis with no stated deadline.