Controls Specialist (Security GRC)

Join Anthropic's Security Governance, Risk, and Compliance (GRC) team as a Controls Specialist. In this individual contributor role, you will own the Common Control Framework, draft and validate control descriptions, design and run continuous monitoring of control efficacy, and support integrated audits. You will work closely with control owners and GRC partners to ensure the accuracy and effectiveness of our control set. This position offers a competitive salary, comprehensive benefits, and the opportunity to work with cutting-edge AI technology.

• Posséder le cadre de contrôle commun : l'ensemble canonique de contrôles, ses correspondances avec SOC 2, ISO 27001/42001, HIPAA, FedRAMP et les engagements des clients.
• Rédiger et valider les descriptions de contrôle et les activités de contrôle avec les propriétaires de contrôle, afin que chaque contrôle indique qui fait quoi, à quelle fréquence, dans quel système et quelle preuve le prouve.
• Concevoir et exécuter une surveillance continue de l'efficacité des contrôles : définir les indicateurs et les tests automatisés qui montrent l'efficacité opérationnelle.

• Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or control library across more than one framework (for example SOC 2, ISO 27001, FedRAMP, HIPAA)
• Experience writing control descriptions, control activities, and test procedures that other teams and external auditors relied on
• Enough technical fluency to read a runbook, a configuration, or a pipeline definition and judge whether it enforces what the written control claims
• Clear writing, because your control language and status reports are what auditors, engineers, and leadership work from
• Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability
• Ability to get control owners and partner teams to prioritize and close work without having authority over them
• Experience with continuous controls monitoring or automated evidence collection, whether you built it, ran it, or audited it
• Education requirements: We require at least a Bachelor's degree in a related field or equivalent experience
• We encourage you to apply even if you do not believe you meet every single qualification
• Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position
• Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience
• Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience
• Have designed or rebuilt a common controls framework and led the remapping of existing frameworks onto it
• Have stood up continuous controls monitoring or automated evidence programs and can speak to coverage, false-positive rates, and what changed as a result
• Have provided requirements for a homegrown GRC platform and worked with the engineers who build it
• Have defined or assessed controls for AI systems or agents operating in production, or for home-built internal systems
• Have applied LLMs to assurance work, such as control drafting, framework mapping, evidence testing, or monitoring