Security Controls Assurance Lead (SOX)

Join Anthropic, a leading AI safety and research company, as a Security Controls Assurance Lead. In this role, you will be responsible for defining control requirements and acceptance criteria for IT general controls (ITGCs) to support Sarbanes-Oxley (SOX) compliance. You will work closely with engineering teams to ensure that controls are designed into systems from the start and will own second-line control monitoring and evidence readiness. This is a critical role as Anthropic scales to meet public-company standards.

Have programming skills in Python or at least one systems language such as Go, Rust, or C/C++

Defined or assessed controls for AI/ML systems or agents acting in production environments

Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices

We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed

About Anthropic

• Are a strong collaborator and communicator across Finance, Engineering, Internal Audit, and external auditors
• Use Claude and other LLMs as daily working tools, and have grounded, specific views on which SOX assurance workflows AI can run today and which it can't yet

Responsibilities

• Definir los requisitos de control y los criterios de aceptación para los sistemas de ingeniería y la infraestructura que están dentro del alcance de la normativa SOX.
• Colaborar con los equipos de ingeniería para diseñar e implementar controles que cumplan con los requisitos establecidos, y validar que lo que se entrega cumple con los estándares antes de las pruebas de auditoría.
• Establecer y supervisar la metodología de diseño de controles y el monitoreo continuo de controles, inicialmente en torno a los controles generales de TI (ITGC), pero extendiéndose a otras áreas de seguridad y cumplimiento.
• Understand the role of the second line: you can advise and challenge engineering without taking ownership of their controls, and you know where the line sits between your monitoring and Internal Audit's independent testing
• Thrive at the pace of a hypergrowth company. You're comfortable making calls with incomplete information and reprioritizing as scope shifts
• Translate SOX and framework language into acceptance criteria engineers can build against, and translate engineering reality back into assurance language auditors and leadership can rely on
• Defined or assessed controls over home-built financially significant systems, usage-based billing, or revenue metering pipelines

Requirements

• Have led or been a senior contributor to an ITGC program through SOX 404 readiness and/or at a public company, with a working command of PCAOB AS 2201, COSO 2013, and how external auditors scope, test, and evaluate technology controls and deficiencies
• Have genuine engineering fluency, possibly from an earlier engineering career: you can read code and Terraform, follow a CI/CD pipeline end to end, and challenge a design on its technical merits
• Have deep familiarity with developer platform, release engineering, cloud infrastructure, or ERP/financial systems control domains
• Default to getting the requirement designed into the system rather than papering over the gap with procedure
• Taken a company through a first-year SOX 404(a) and 404(b) assessment, including a first external ITGC audit
• Stood up continuous controls monitoring or automated evidence programs
• Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience
• Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience
• Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls

Preferred

• A combination of audit or advisory experience (Big 4 or equivalent, ideally IT audit) with in-house experience at an AI-forward tech company, in either order
• CISSP, CISA, CPA, or equivalent certification

Pay

USD 410,000 - 510,000