Lead - Security Controls Assurance - SOX

About the Role

Anthropic's Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into controls that teams act on, building toward continuous assurance to challenge and evidence control performance continuously.

As part of Security GRC's technical controls assurance function, you will define control requirements and acceptance criteria for in-scope engineering systems and infrastructure supporting SOX 404 compliance. You will partner with engineering to validate implementations before internal and external audit testing, acting as the product owner for control design methodology and continuous control monitoring.

Key Responsibilities

• Define control requirements and acceptance criteria: Cover core ITGC domains (logical access, change management, computer operations, program development) for SOX in-scope systems, including home-built platforms.
• Set the bar for in-scope systems: Define auditability, segregation of duties, change control, immutable logging, and evidence retention requirements before go-live.
• Pressure-test changes for SOX impact: Review major infrastructure, system, and agent framework changes during design to evaluate SOX scope and control impacts.
• Own second-line control monitoring and evidence readiness: Implement continuous controls monitoring and automated evidence collection for ITGCs.
• Drive control deficiency remediation: Root-cause ITGC deficiencies, partner with engineering on remediation design, and validate gap closure.
• Assess scope changes: Provide technical and compliance impact assessments on new products, entities, systems, or integrations.
• Maintain alignment with compliance frameworks: Align SOX ITGCs with frameworks such as SOC 2 and ISO 27001/42001.

Minimum Qualifications

• Experience leading or contributing as a senior member to an ITGC program through SOX 404 readiness or at a public company, with working knowledge of PCAOB AS 2201 and COSO 2013.
• Engineering fluency: ability to read code and Terraform, follow CI/CD pipelines, and evaluate technical designs.
• Programming proficiency in Python or a systems language such as Go, Rust, or C/C++.
• Deep familiarity with developer platforms, release engineering, cloud infrastructure, or ERP/financial systems control domains.
• Clear understanding of second-line assurance boundaries relative to engineering and Internal Audit.
• Strong collaboration and communication skills across Finance, Engineering, Internal Audit, and external auditors.
• Daily working familiarity using Claude and LLMs, with grounded perspectives on automated SOX assurance workflows.
• Ability to translate between technical engineering realities and regulatory assurance requirements.

Preferred Qualifications

• Audit/advisory experience (Big 4 or equivalent IT audit) combined with in-house tech company experience.
• Experience navigating first-year SOX 404(a) and 404(b) assessments, including external ITGC audits.
• Experience assessing controls for home-built financially significant systems, billing pipelines, or production AI/ML systems.
• Track record standing up continuous controls monitoring or automated evidence programs.
• Familiarity with SOC 1 reliance, service organization control mapping, and complementary user entity controls.
• Relevant professional certifications such as CISSP, CISA, or CPA.