Security Risk & Compliance, SOX IT
Anthropic · San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC
About this role
**Security Risk & Compliance (SOX IT)** **About Anthropic** Anthropic’s mission is to create reliable, interpretable, and steerable AI systems—safe and beneficial for users and society. **About the role** Anthropic’s Security Governance, Risk, and Compliance (GRC) team translates regulatory, customer, and voluntary obligations into controls teams can execute, and provides leadership visibility into control performance. This role sits in Security GRC’s technical controls assurance function, driving what IT general controls (ITGCs) must achieve to support **SOX 404 compliance**. You’ll partner with Internal Audit’s IT SOX team (independent testing) by defining control requirements, monitoring control operation, and ensuring evidence is audit-ready. You’ll also work with Engineering, Security, IT, and Finance to validate that what ships meets the bar—and with GRC engineering to automate evidence collection and continuous monitoring. **Key responsibilities** - Define control requirements and acceptance criteria across core **ITGC domains**: logical access, change management, operations, and program development (including home-built platforms). - Set the bar from day one: define go-live requirements for financially significant systems and assess SDLC controls so controls aren’t retrofitted. - Pressure-test SOX impact during design by reviewing major infrastructure/system/agent framework changes while decisions are still cheap. - Perform second-line monitoring and readiness testing: test key **ITGCs** and **IT automated controls (ITACs)** ahead of Internal Audit and external auditors. - Build continuous monitoring and evidence readiness: stand up automated evidence collection/monitoring, map controls to the common controls framework, and increase automated evidence coverage. - Run system and process risk assessments; identify control gaps and recommend remediation. - Drive control deficiency remediation with cross-functional partners; track/root-cause issues and verify remediation closes gaps before re-testing. - Support external audit with Finance and Internal Audit: prepare walkthroughs, evidence requests, and testing schedules. - Assess scope changes through a SOX lens when new products/entities/systems/integrations come into scope. - Maintain alignment with the broader compliance portfolio, including support for SEC cybersecurity disclosure requirements. **You may be a good fit if you** - Thrive in hypergrowth: make calls with incomplete information and reprioritize as scope shifts. - Have senior experience with ITGC programs through SOX 404 readiness and/or public-company SOX work, with working knowledge of **PCAOB AS 2201** and **COSO 2013**. - Have hands-on IT audit/IT SOX experience designing, testing, and documenting controls across access management, change management, and operations. - Have hands-on engineering fluency (e.g., read code and Terraform; follow CI/CD end-to-end; challenge designs technically). - Are familiar with developer platforms, release engineering, cloud infrastructure, or ERP/financial systems control domains. - Can collaborate across Finance, Engineering, Internal Audit, and external auditors while independently managing complex workstreams. - Use Claude and other LLMs as daily tools, with grounded views on what SOX assurance workflows AI can/can’t do today. - Translate SOX/framework language into engineer-ready acceptance criteria—and translate engineering reality back into assurance language. - Default t
Listing freshness
CronJobs last confirmed this listing 58m ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.