Security Risk & Compliance, Agent Security
San Francisco, CA | New York City, NY · New York City, NY · San Francisco · Seattle, WA · Washington, D.C. · USD 255,000-345,000 / year · 8+ years experience · Hybrid · Posted Sep 22, 2026
At a glance
- Experience
- 8+ years experience
- Workplace
- Hybrid
- Location
- San Francisco, CA | New York City, NY · New York City, NY · San Francisco · Seattle, WA · Washington, D.C.
- Salary
- USD 255,000-345,000 / year · Base salary
- Visa sponsorship
- Visa sponsorship available
About Anthropic
- Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the role
- The Security Risk & Compliance, Agent Security role focuses on establishing governance, risk, and compliance frameworks specifically for AI agents.
- You will define policies, standards, and review criteria for how agents are built, deployed, and operated, ensuring they remain secure and auditable.
- This role involves partnering with cross-functional teams to monitor agent behavior and adapt security controls in an evolving AI landscape.
Responsibilities
- Serve as the security policy partner for AI agent governance, authoring policies and standards for agent development and deployment.
- Define review and approval criteria for agents interacting with sensitive or regulated data.
- Serve as the GRC reviewer within existing engineering approval workflows.
- Define data governance requirements for agents, including least-privilege access and access reviews.
- Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional teams.
- Map agent security and data controls to AI governance frameworks like ISO 27001, ISO 42001, and the EU AI Act.
- Assess and document agent-related security and compliance risks, driving them to resolution with engineering owners.
- Own the policy for agent-related risk acceptances and exceptions, including approval authority and re-review cycles.
Requirements
- 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company.
- Experience supporting efforts to compartmentalize sensitive data, PII, or intellectual property.
- Understanding of how identity and access mechanisms implement or undermine protection boundaries.
- Ability to design least-privilege access and accountability controls for non-human identities.
- Ability to reason from a threat model to a control and explain tradeoffs to technical and non-technical audiences.
- Experience defining risk-based review or approval criteria within engineering workflows.
- Bachelor’s degree or an equivalent combination of education, training, and/or experience in a relevant field.
Preferred qualifications
- Understanding of the security properties of LLM agents.
- Familiarity with AI governance frameworks alongside traditional security frameworks.
- Experience adapting controls from regulated or highly sensitive environments to an open, high-trust engineering culture.
- Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSP, or ISO 27001/42001 Lead Implementer/Auditor.
Benefits
- Competitive compensation
- Optional equity donation matching
- Generous vacation
- Parental leave
- Flexible working hours
Workplace
- Location-based hybrid policy: staff are expected to be in one of the offices at least 25% of the time.
- Some roles may require more time in the office.
Skills
- ISO 27001
- ISO 42001
- EU AI Act
- LLM
- GRC
