Audit, Security GRC

Job summary

Responsibilities

You'll help run Anthropic's unified audit program: quarterly audits across SOC 2, HIPAA and the ISO 27000 family including ISO 42001, plus the rest of our certifications, working with our audit firms, our GRC Partners, and control owners across the company.

• Run the audit program as a program: one integrated plan and calendar across audits and expansions, with milestones, dependencies, risks and decisions tracked, and regular status…
• Plan and run the quarterly audits, from scoping through report and findings closeout
• Run audit readiness ahead of each fieldwork window: control owner prep, evidence pre-checks and walkthrough dry runs
• Scope each audit's boundary with Product and Engineering: which products and deployment paths are in scope, and flag when a launch or new platform changes it
• Help build the audit operating model and runbook for a unified audit program, and keep both current as the program grows

What they're looking for

• Several years of program management: running multi-workstream programs with a plan, milestones, dependencies, risk tracking and status reporting to leadership
• Several years running external security audits (SOC 2 and ISO 27001 at minimum), on the company side or at an audit firm, including seasons with several frameworks at once
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001 and HIPAA, and where their requirements overlap
• Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership
• Experience building or improving an audit process: calendars, request tracking, runbooks, roles and responsibilities