Audit (Security Governance, Risk, and Compliance)

Join Anthropic's Security Governance, Risk, and Compliance (GRC) team as an Audit & Assurance professional. In this role, you will help run the integrated audit program, plan new audits, and assess frameworks and scope changes. You will work closely with control owners and GRC partners, manage auditor relationships, and report audit status and findings to GRC leadership. This is an individual contributor role for someone with program management experience who writes clearly, stays calm under deadlines, and enjoys simplifying busy programs.

• Plan and run the quarterly audits, from scoping through report and findings closeout.
• Run the audit program as a program: one integrated plan and calendar across audits and expansions, with milestones, dependencies, risks and decisions tracked.
• Drive automation in the program: evidence collected from source systems, request tracking and audit reporting, with evidence and walkthroughs reused across frameworks.

• Clear writing and calm coordination under deadline pressure
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001 and HIPAA, and where their requirements overlap
• Enough technical fluency to understand how evidence is produced in cloud environments and to judge whether a system-generated report is complete and accurate, and to build simple automations with Claude
• Several years running external security audits (SOC 2 and ISO 27001 at minimum), on the company side or at an audit firm, including seasons with several frameworks at once
• Ability to get control owners to deliver on time without authority over them
• Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership
• Several years of program management: running multi-workstream programs with a plan, milestones, dependencies, risk tracking and status reporting to leadership
• Experience building or improving an audit process: calendars, request tracking, runbooks, roles and responsibilities
• Prior AI industry experience
• CISA, CISSP, ISO 27001 Lead Auditor or similar are welcome but not required
• Audit firm experience (Big 4 or a SOC 2 or ISO certification body), especially as a senior or manager on technology clients
• Experience adding new frameworks such as PCI DSS, ISO 27701 or 27018, CSA STAR, or international schemes (for example IRAP, ISMAP or C5)
• Experience with a GRC platform or building lightweight internal tooling
• Have automated evidence collection or audit reporting, or use Claude or other LLMs day to day to plan, track and report program work
• You don't need to have done everything on this list. The combination is running a global audit calendar well, plus the instinct to make it simpler each cycle
• We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed