Security Risk & Compliance (Agent Security)

• Anthropic’s Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments
• We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird’s-eye view of how well we’re meeting them
• We’re building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits
• Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated
• Define review and approval criteria when an agent may interact with sensitive or regulated data, and which actions require human approval as it relates to compliance frameworks
• Serve as the GRC reviewer within existing engineering approval workflows
• Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data
• Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional security, research and engineering teams
• Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act), strengthening Anthropic’s certification efforts ensuring agent security is auditable
• Assess and document agent-related security and compliance risks, driving them to resolution with engineering owners
• Own the policy for agent-related risk acceptances and exceptions, including approval authority, duration and re-review

Benefits

• Comprehensive health, dental, and vision insurance for you and your dependents
• Inclusive fertility benefits via Carrot Fertility
• 22 weeks of paid parental leave
• Flexible paid time off and absence policies
• Mental health support for you and your dependents
• Competitive salary and equity packages
• Optional equity donation matching at a 1:1 ratio, up to 25% of your equity grant
• Retirement plans with competitive matching
• Life and income protection plans
• $500/month flexible wellness and time saver stipend
• Commuter benefits
• Annual education stipend
• Home office stipends
• Relocation support for those moving for Anthropic
• Daily meals and snacks in the office- Have 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
• Have defined risk-based review or approval criteria within engineering workflows and kept them effective under high change velocity
• Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor
• Are energized by being the security and risk authority who educates and influences outcomes rather than only advises
• Thrive in ambiguous environments with no settled industry playbook, where you’re expected to propose the standard rather than wait for one
• Deliver clear, precise written work for both technical and non-technical audiences
• Think about non-human identities as a distinct risk and control category, and can design least-privilege access and accountability controls for systems acting on a person’s behalf
• Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries
• We encourage you to apply even if you do not believe you meet every single qualification
• Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor)
• Bring familiarity with AI governance frameworks alongside traditional security frameworks
• Have adapted controls from regulated or highly sensitive environments to an open, high-trust engineering culture
• Understand the security properties of LLM agents, whether from an AI, developer-platform, or agent-tooling company, or through comparable experience