Security Risk Analyst (Risk Engineering)

Join Anthropic, a leading AI safety and research company, as a Security Risk Analyst. In this role, you will be responsible for identifying, prioritizing, and driving the treatment of the company's most important security risks. You will work closely with Security Engineering to define the security program and shape investment and treatment decisions. Your work will have a direct impact on CISO-level decisions and the overall security landscape of the company.

• Identifying, prioritizing, and driving treatment of security risks within the organization.
• Rebuilding risk management to operate as an engineering function, using automation and quantitative risk analysis.
• Partnering with Security Engineering to assess threat scenarios and control effectiveness, ensuring security investment is aligned with actual risk.

• Have enough technical security depth to decompose an attack path with security engineers and be credible in the room
• Thrive in ambiguity. You frame a moving question into something analyzable, pick the depth that fits, and drive to a decision rather than a report
• Are low ego and collaborative, build credibility through the work, and care about AI safety and the role security risk plays in it
• Have owned security or technology risk analysis end to end, qualitative and quantitative, and can point to a decision your output changed, whether a funding call, a launch call, a remediation sequence, or a documented acceptance
• Put defensible severity and likelihood on ambiguous problems, state uncertainty honestly, and change your position when the evidence changes
• Have hands-on FAIR-style quantification experience, including scenario decomposition, calibrated estimation, and Monte Carlo simulation in Python, R, or spreadsheet tooling, briefed to decision makers
• Use Claude or other LLMs as daily working tools and review model output critically
• Can compress a complex risk position into one paragraph for the CISO, make the tradeoff explicit, and defend it under pointed questions
• Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience
• Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience
• Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position
• We encourage you to apply even if you do not believe you meet every single qualification
• Have applied FAIR-CAM or another structured approach to control effectiveness and attack path modeling
• Have built or operated a cyber risk quantification program, or turned quantitative analysis into tooling, templates, or training that others ran
• Have helped define risk appetite or tolerance thresholds an organization actually used to make decisions
• Bring a background in security engineering, detection, threat intelligence, actuarial science, or decision science that grounds the numbers in real systems
• Are familiar with security risks specific to AI systems, such as goal or intent modification, and how they change traditional threat models