← All roles

Controls Specialist, Security GRC

Anthropic· Security
Apply on company site
Hybrid (San Francisco, CA), Hybrid (New York, NY), Hybrid (Seattle, WA)$270k - $345kFull-timePosted 2w ago

About the role

Role within Anthropic's Security Audit & Controls team owning the Common Control Framework (CCF) across all control domains, mapping to frameworks, testing evidence, and driving continuous monitoring and remediation in collaboration with control owners and GRC Partners.

Responsibilities

  • Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding, retiring, or rewording controls
  • Draft and validate control descriptions and control activities with control owners, so each control states who does what, how often, in which system, and what evidence proves it
  • Design and run continuous monitoring of control efficacy: define the metrics and automated tests that show operating effectiveness, tune out false positives, surface failures to owners before an auditor does, and build the controls maturity model that shows where each control domain stands and what it takes to move up a level
  • Verify remediation and carry it into steady state: advise on control design and implementation, confirm fixes against what the auditor asked for, and maintain a single source of truth for control and finding status; standardize evidence pull and automate where appropriate
  • Map new frameworks and commitments onto the CCF and support gap assessments when new frameworks, certifications, products, or entities come into scope
  • Support integrated audits and customer audits: readiness checks, walkthrough preparation, evidence request lists, and readout of external findings to GRC
  • Evaluate evidence reliability, including system-generated and AI-generated evidence, and set the standard for audit-ready evidence
  • Build with Claude: automate control mapping, evidence testing, and monitoring, and verify machine-drafted control language before it becomes the record

Qualifications

  • Several years in IT audit, security compliance, or controls assurance with hands-on ownership of a control framework across multiple frameworks (e.g., SOC 2, ISO 27001, FedRAMP, HIPAA)
  • Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability
  • Experience writing control descriptions, control activities, and test procedures relied on by teams and external auditors
  • Experience with continuous controls monitoring or automated evidence collection
  • Technical fluency to read runbooks, configurations, or pipelines and judge enforcement of controls
  • Clear writing for control language and status reports
  • Ability to coordinate with control owners and partner teams to prioritize and close work without direct authority over them

Skills

Required:Common Control Framework (CCF)Control description and testingContinuous controls monitoringEvidence management

Benefits

  • Competitive compensation and benefits
  • optional equity donation matching
  • generous vacation and parental leave
  • flexible working hours
  • lovely office space
Last updated Oct 7, 2026. Interested? Apply on the company site.

About Anthropic

building reliable, interpretable, and steerable AI systems

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

ai-infrastructure-and-developmentliquid-ai-recruiting-targetsetter-30setter-30-2026-q1wing-list-2026wing-list-2026-giga-stage
Company profileWebsite

More open roles at Anthropic