Audit, Security GRC

San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC · San Francisco · USD 255,000-270,000 / year · Hybrid · Posted Oct 19, 2026

At a glance

Workplace: Hybrid
Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC · San Francisco
Salary: USD 255,000-270,000 / year · Base salary
Visa sponsorship: Visa sponsorship available

Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.

This role sits in Audit & Assurance and helps run Anthropic's integrated audit program, plan new audits, and assess frameworks and scope changes.
You will help run a unified audit program featuring quarterly audits across SOC 2, HIPAA, and the ISO 27000 family including ISO 42001.
The position drives automation in the program so evidence is collected once and reused across frameworks, using Claude as part of the daily workflow.

Run the audit program as a program with one integrated plan and calendar across audits and expansions, tracking milestones, dependencies, risks, and decisions.
Plan and run quarterly audits from scoping through report and findings closeout.
Run audit readiness ahead of each fieldwork window, including control owner prep, evidence pre-checks, and walkthrough dry runs.
Scope each audit's boundary with Product and Engineering and flag when a launch or new platform changes it.
Help build the audit operating model and runbook for a unified audit program and keep both current as the program grows.
Drive automation in the program regarding evidence collected from source systems, request tracking, and audit reporting.
Coordinate audits across frameworks and firms so audit windows line up and control owners are asked for the same evidence once.
Plan new audits and audit expansions as we commit to them, running framework and scope expansion evaluations and gap assessments.
Work closely with control owners and GRC Partners to prepare control owners, get evidence delivered, and hand findings that need extended remediation.
Manage day-to-day auditor relationships and report audit status, findings, and program metrics to GRC leadership.

Several years of program management running multi-workstream programs with a plan, milestones, dependencies, risk tracking, and status reporting to leadership.
Several years running external security audits (SOC 2 and ISO 27001 at minimum), on the company side or at an audit firm, including seasons with several frameworks at once.
Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and HIPAA, and where their requirements overlap.
Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership.
Experience building or improving an audit process including calendars, request tracking, runbooks, and roles and responsibilities.
Technical fluency to understand how evidence is produced in cloud environments, judge whether system-generated reports are complete and accurate, and build simple automations with Claude.
Clear writing and calm coordination under deadline pressure.
Ability to get control owners to deliver on time without authority over them.
Bachelor's degree or an equivalent combination of education, training, and/or experience.
A field of study relevant to the role as demonstrated through coursework, training, or professional experience.

Audit firm experience (Big 4 or a SOC 2 or ISO certification body), especially as a senior or manager on technology clients.
Experience adding new frameworks such as PCI DSS, ISO 27701 or 27018, CSA STAR, or international schemes (for example IRAP, ISMAP, or C5).
Have automated evidence collection or audit reporting, or use Claude or other LLMs day to day to plan, track, and report program work.
Experience with a GRC platform or building lightweight internal tooling.

Location-based hybrid policy expecting staff to be in one of the offices at least 25% of the time, with some roles requiring more time in offices.
Offices located in San Francisco, CA, Seattle, WA, New York City, NY, and Washington, DC.