Description
Anthropic's Supplier Security & Assurance (SSA) team, part of Security GRC, assesses the security of suppliers. The SSA team evaluates vendors to ensure they meet security requirements and provides the business with approval decisions.
As a member of the Supplier Security & Assurance team, you will run supplier security assessments end-to-end. This involves reviewing evidence, verifying agent-drafted evaluations, determining inherent and residual risk, and driving findings to closure with vendors and business owners. You will also extend assurance past approval by implementing contractual security terms, secure configuration baselines, continuous monitoring, and reassessment.
Key responsibilities:
- Run supplier security assessments: review agent-prefilled outputs, evaluate vendor controls and evidence, determine residual risk, and route to domain reviewers where deeper assessment is warranted
- Operate supplier issue management and risk treatment: document each finding with a severity, an owner, and a due date, drive remediation with the vendor and the business owner, record risk acceptances, and roll open issues up to the risk register
- Run continuous monitoring after approval: reopen an assessment on defined triggers, investigate SaaS configuration, data, and use case drift signals, and queue a reassessment where the vendor's scope has moved
- Improve the program: identify gaps in coverage, questionnaires, requirements, and tooling that surface during assessments, propose fixes, and carry roadmap items that mature supplier security overall
- Tune and maintain the Claude-powered assessment platform: prompt development, questionnaire and assessment type design, calibration against assessor decisions, and output QA
- Contribute to KPI and KRI reporting on coverage, cycle time, residual risk, open issues, and reassessments due
Minimum qualifications:
- Experience running supplier security assessments end-to-end at a technology company
- Working knowledge of risk fundamentals and the judgment to apply them
- Ability to assess a vendor across security domains and recognize which findings need a security domain specialist
- Track record of driving risk treatment to closure through influence across teams
- Experience building or tuning an LLM-backed workflow or automation in a risk, compliance, or operations context
- Experience building or operating issue management workflows
- Working technical knowledge of SaaS security configuration and standard vendor security contract terms
- Ability to read a SOC 2 report or penetration test and turn it into findings
Preferred qualifications:
- Experience assessing cloud infrastructure, data center, or data-pipeline vendors
- Experience supporting SOX, SOC 2, or ISO 27001 third-party or vendor management controls
- Experience assessing additional, more specialized vendor cohorts from a security risk perspective
- Experience with post-approval supplier continuous monitoring
The annual compensation range for this role is $255,000-$270,000 USD.