US Public Sector Compliance, Security GRC

Job summary

Responsibilities

You'll help drive the compliance programs that keep Anthropic's US government authorizations current: federal civilian (FedRAMP, including FedRAMP 20x for Claude Enterprise), Department of War (DoD impact levels, CMMC, NIST SP 800-171), and state and local (StateRAMP, TX-RAMP and agency…

• Run the recurring compliance cycles for our US government authorizations (continuous monitoring, POA&M, annual assessments, SSP updates, significant changes and incident…
• Co-own FedRAMP 20x work for Claude Enterprise, and help build new authorizations (first-party FedRAMP High, DoW impact levels, StateRAMP and TX-RAMP) with requirements and…
• Support model authorizations in GovCloud and Vertex for every model launch, as the GRC member of the Inference and model delivery pod
• Translate government obligations into partner team requirements, for example vulnerability SLAs in our internal vulnerability reporting platform, and review the evidence
• Answer public sector customer and deal questions (what a boundary allows, CUI, IRS Publication 1075, CJIS, ITAR), and handle questionnaires and RFIs until they move to Customer…

What they're looking for

• Several years in security compliance or IT audit with hands-on US government compliance for a cloud service (FedRAMP, DoD impact levels, CMMC or NIST SP 800-171, or StateRAMP)…
• Working command of the NIST SP 800-53 Moderate baseline and the mechanics of authorization: boundary definition, control implementation statements, assessment, continuous…
• Experience writing requirements for engineering teams from a control baseline and reviewing the evidence that came back
• Working knowledge of how a GovCloud or Vertex style government region differs from commercial, and what changes when a model, feature or region is added to an authorized boundary
• Enough technical fluency to read a runbook, configuration or pipeline definition and judge whether it enforces the written control