Supplier Security & Assurance, Security GRC

Job summary

Responsibilities

Anthropic's Supplier Security & Assurance (SSA) team sits within Security GRC and is responsible for assessing the security of our suppliers: evaluating whether vendors meet our security requirements, capturing the deviations, and giving the business a clear approval decision it can act on.

• Run supplier security assessments: review agent-prefilled outputs, evaluate vendor controls and evidence, determine residual risk, route to domain reviewers where deeper…
• Operate supplier issue management and risk treatment: document each finding with a severity, an owner, and a due date, drive remediation with the vendor and the business owner…
• Run continuous monitoring after approval: reopen an assessment on defined triggers (data classification change, new SOC 2 report, new subprocessor, vendor incident), investigate…
• Improve the program as you run it: identify gaps in coverage, questionnaires, requirements, and tooling that surface during assessments, propose the fix, and carry roadmap items…
• Tune and maintain our Claude-powered assessment platform alongside the team: prompt development, questionnaire and assessment type design, calibration against assessor decisions…

What they're looking for

• Experience running supplier security assessments end to end at a technology company: scoping the engagement, determining inherent risk, reviewing controls and evidence…
• Working knowledge of risk fundamentals (inherent and residual risk, control effectiveness, compensating controls, risk acceptance) and the judgment to apply them when the…
• Ability to assess a vendor across security domains, and to recognize which findings you can close yourself and which need a security domain specialist
• Track record of driving risk treatment to closure through influence across teams with competing priorities
• Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including tuning prompts and reviewing model output for…