Lead, Security Controls Assurance - SOX
About this role
The Security Governance, Risk, and Compliance team at Anthropic is building towards continuous assurance to challenge and evidence the performance of security controls continuously across the technology stack. As the company scales to meet public-company standards, the Sarbanes-Oxley control environment becomes one of the most consequential operational areas. This role serves as the product owner for control design methodology and continuous control monitoring, specifically driving technical controls assurance for IT general controls.
The person in this position will define control requirements and acceptance criteria for in-scope engineering systems and infrastructure that underpin financial reporting. Working alongside Internal Audit and engineering teams, the specialist ensures that security controls are designed directly into home-built platforms and cloud infrastructure before systems go live. The ideal candidate brings engineering fluency combined with deep expertise in SOX 404 readiness, enabling them to translate compliance requirements into technical specifications that developers can actually build against.
What you will do
- Define control requirements and acceptance criteria across core IT general control domains for SOX in-scope systems.
- Partner with engineering teams during the design phase of major infrastructure, system, and agent framework changes to assess SOX impact.
- Stand up continuous controls monitoring and automated evidence collection for IT general controls to reduce audit preparation time.
- Drive remediation for control deficiencies by identifying root causes and assessing fixes with cross-functional partners.
- Provide technical and compliance assessments for new products, entities, and integrations entering the SOX scope.
- Ensure seamless alignment between SOX IT general controls and other frameworks such as SOC 2 and ISO standards.
What you need
- Demonstrated experience leading or contributing to an IT general controls program through SOX 404 readiness or at a public company.
- Working command of PCAOB AS 2201, COSO 2013, and external auditor evaluation methods.
- Engineering fluency including the ability to read code, review Terraform, navigate CI/CD pipelines, and write Python or systems languages like Go, Rust, or C/C++.
- Deep familiarity with developer platform, release engineering, cloud infrastructure, or financial systems control domains.
- Strong collaboration skills to advise and challenge engineering teams while maintaining clear boundaries with Internal Audit.
- Practical experience using Claude and other large language models as daily working tools.
Nice to have
- Combined audit or advisory experience with in-house experience at an AI-forward technology company.
- Experience taking a company through a first-year SOX 404 assessment and external IT audit.
- Background in defining controls for home-built financially significant systems, usage-based billing, or AI and machine learning systems.
- Familiarity with service organization control mapping and complementary user entity controls.
- Professional certifications such as CISSP, CISA, or CPA.
Skills and tech stack
Questions candidates ask
What is the remote work and office policy for this job?
Anthropic operates under a location-based hybrid policy where staff are expected to be in one of the designated offices at least 25% of the time, though certain roles may require a higher in-office presence.
What is the annual salary range for this position?
The annual salary range for this role is $410,000 to $510,000 USD.
Does the company provide visa sponsorship for applicants?
Yes, visa sponsorship is available, and the company retains an immigration lawyer to assist candidates who receive an offer.
What tools and technologies are expected in daily work?
Candidates should have programming skills in Python or systems languages like Go, Rust, or C++, work with Terraform and CI/CD pipelines, and use Claude and other large language models as daily working tools.