Controls Specialist, Security GRC
About this role
Professionals who thrive in autonomous environments and take genuine satisfaction in maintaining accurate, well-tested compliance frameworks will find a great fit here. The Security Governance, Risk, and Compliance team at Anthropic serves as the foundational accountability layer for the company, translating regulatory and customer obligations into actionable controls while giving leadership a clear view of performance. Within the Audit & Assurance group, this individual contributor will own the Common Control Framework across domains ranging from access management to encryption and people controls. Day-to-day responsibilities involve drafting precise control descriptions, establishing continuous monitoring to prove operating effectiveness, and working directly with control owners to drive remediation efforts to closure. Building alongside Claude is a regular part of the workflow, utilizing AI to assist with control mapping, evidence testing, and monitoring while retaining ultimate human judgment.
What you will do
- Manage the Common Control Framework, including the canonical control set, its mappings to frameworks like SOC 2 and ISO 27001, and the change management process for controls.
- Collaborate with control owners to draft and validate accurate control descriptions and activities that reflect real-world execution.
- Design and execute continuous monitoring of control efficacy by defining automated tests and metrics to show operating effectiveness.
- Advise on control design and remediation, verifying fixes against auditor requirements and maintaining a single source of truth for findings.
- Map new frameworks and commitments onto the framework while supporting gap assessments for new products, certifications, or entities.
- Facilitate integrated audits and customer audits through readiness checks, walkthrough preparation, and evidence compilation.
- Evaluate evidence reliability and system-generated reports to establish high standards for audit readiness across the organization.
- Utilize Claude to automate tasks such as control mapping, evidence testing, and monitoring while verifying machine-drafted language.
What you need
- Several years of professional experience in IT audit, security compliance, or controls assurance, including hands-on ownership of a control library across multiple frameworks.
- Demonstrated command of audit mechanics such as scoping, walkthroughs, sampling, and design versus operating effectiveness.
- Practical background in writing clear control descriptions, activities, and test procedures relied upon by external auditors.
- Familiarity with continuous controls monitoring or automated evidence collection methods.
- Technical fluency sufficient to read runbooks, configurations, or pipeline definitions to evaluate control enforcement.
- Clear and effective written communication skills suitable for technical reports and cross-functional collaboration.
Nice to have
- Experience designing or rebuilding a common controls framework and leading framework remappings.
- Direct background in standing up continuous controls monitoring or automated evidence programs.
- Application of LLMs to assurance work such as control drafting or framework mapping.
- Experience defining or assessing controls for production AI systems or internal platforms.
- Prior involvement in providing requirements for homegrown GRC platforms.
Benefits
- Visa sponsorship support with retained immigration counsel
Skills and tech stack
Questions candidates ask
What is the remote or office policy for this role?
Anthropic operates under a location-based hybrid policy. Staff members are currently expected to work from an office in San Francisco, New York City, or Seattle at least 25% of the time, though certain roles may require additional in-office days.
What is the compensation range for this position?
The annual base salary range for this role is between $270,000 and $345,000 USD.
Will I be expected to write production code?
Writing production code is not required for this job. The necessary technical bar involves fluency sufficient to read, query, and challenge technical definitions and runbooks.
What tools and technologies are used in this role?
This position involves building alongside Claude to automate control mapping, evidence testing, and monitoring. The work spans various compliance frameworks including SOC 2, ISO 27001, ISO 42001, HIPAA, and FedRAMP.
Are professional certifications required to apply?
Certifications such as CISA or CISSP are welcome but not required. The role focuses heavily on framework ownership and the practical judgment to evaluate control effectiveness.