Controls Specialist, Security GRC

Individual contributor in Anthropic's Security GRC organisation, within the Audit & Assurance group, who owns the Common Control Framework, the single control set the company's compliance program rests on. The framework covers all domains, including access, change management, logging, encryption and people, and the role keeps its mappings to SOC 2, ISO 27001 and 42001, HIPAA, FedRAMP and customer commitments. The specialist writes control descriptions with owners that reflect how things actually work, builds continuous monitoring of control effectiveness, verifies remediation, maps new frameworks, supports audits, judges evidence reliability, and uses Claude to automate mapping and testing.

The team wants several years of IT audit, controls assurance or security compliance work, with ownership of a multi-framework control library, solid audit mechanics and enough technical fluency to check configurations against controls. Hybrid, in an office at least a quarter of the time.