Controls Specialist, Security GRC

About the Team

Anthropic's Security Governance, Risk, and Compliance (GRC) team holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits.

Within Security GRC, Compliance & Audit Programs runs the integrated audit across our frameworks and maintains the Common Control Framework (CCF). This role sits in Audit & Assurance and owns the framework and the assurance view across every control domain.

About the Role

As part of the Security Audit & Controls team, you will own the CCF across every control domain, from access and change management to logging, encryption, and people controls: which controls we have, what each one says, how each maps to the frameworks and commitments we hold, and whether each one is actually working. You'll work with control owners and GRC Partners to draft and validate control descriptions and activities, build continuous monitoring, and drive findings to closure.

Key Responsibilities

• Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding, retiring, or rewording controls.
• Draft and validate control descriptions and control activities with control owners to clearly define who does what, how often, in which system, and what evidence proves it.
• Design and run continuous monitoring of control efficacy, defining metrics and automated tests to surface failures before external auditors do.
• Verify remediation and advise on control design, confirming fixes against auditor expectations and maintaining a single source of truth for findings.
• Map new frameworks and commitments onto the CCF and support gap assessments for new products, certifications, or entities.
• Support integrated audits and customer audits: readiness checks, walkthrough preparation, evidence request lists, and readout of external findings.
• Evaluate evidence reliability, including completeness and accuracy of system-generated reports and AI-generated evidence.
• Build with Claude to automate control mapping, evidence testing, and monitoring.

Qualifications

Minimum Qualifications

• Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or library across multiple frameworks (e.g., SOC 2, ISO 27001, FedRAMP, HIPAA).
• Working command of audit mechanics: scoping, walkthroughs, sampling, design vs. operating effectiveness, deficiency evaluation, and evidence reliability.
• Experience writing control descriptions, control activities, and test procedures relied on by teams and external auditors.
• Experience with continuous controls monitoring or automated evidence collection.
• Sufficient technical fluency to read runbooks, configurations, or pipeline definitions to evaluate control enforcement.
• Clear written communication skills.
• Ability to influence control owners and partner teams without direct authority.

Preferred Qualifications

• Designed or rebuilt a common controls framework and led remapping of existing frameworks onto it.
• Stood up continuous controls monitoring or automated evidence programs.
• Applied LLMs to assurance work (e.g., control drafting, framework mapping, evidence testing, monitoring).
• Defined or assessed controls for AI systems/agents in production or home-built internal systems.
• Provided requirements for a homegrown GRC platform and collaborated with engineers to build it.
• CISA, CISSP, or similar certifications.