Lead, Security Controls Assurance - SOX

Anthropic's Security Governance, Risk, and Compliance (GRC) team is seeking a Lead, Security Controls Assurance - SOX to ensure the company's security and control commitments are met. The successful candidate will be responsible for defining control requirements and acceptance criteria for in-scope engineering systems and infrastructure, partnering with Internal Audit, and validating that implemented controls meet the required standards.

Key responsibilities:

• Define control requirements and acceptance criteria across ITGC domains for SOX in-scope systems.
• Set the bar for in-scope systems from day one, ensuring controls are designed into the system.
• Pressure-test changes for SOX impact during design and maintain a clear view of changes that alter the SOX scope.
• Own second-line control monitoring and evidence readiness, standing up continuous controls monitoring and automated evidence collection.
• Drive control deficiency remediation with cross-functional partners.
• Assess scope changes through a SOX lens and provide technical and compliance assessments.
• Maintain alignment with the broader compliance portfolio, ensuring controls are designed once and evidenced once.

Minimum qualifications:

• Experience leading or contributing to an ITGC program through SOX 404 readiness or at a public company.
• Genuine engineering fluency, possibly from an earlier engineering career.
• Programming skills in Python or a systems language such as Go, Rust, or C/C++.
• Deep familiarity with developer platforms, release engineering, cloud infrastructure, or ERP/financial systems control domains.
• Strong collaboration and communication skills across Finance, Engineering, Internal Audit, and external auditors.

Preferred qualifications:

• A combination of audit or advisory experience with in-house experience at an AI-forward tech company.
• Experience taking a company through a first-year SOX 404(a) and 404(b) assessment.
• Defined or assessed controls over home-built financially significant systems or AI/ML systems.
• Stood up continuous controls monitoring or automated evidence programs.
• CISSP, CISA, CPA, or equivalent certification.

The annual compensation range for this role is $410,000-$510,000 USD.