SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 255,000 - 270,000 / annual
Anthropic's Security Governance, Risk, and Compliance (GRC) team is seeking an experienced Audit & Assurance Program Manager to run the company's unified audit program. This role sits within the Audit & Assurance function and is responsible for managing integrated audits across SOC 2, HIPAA, ISO 27000 family (including ISO 42001), and other certification frameworks.
Key responsibilities include:
- Running Anthropic's unified audit program as an integrated plan with quarterly audits across multiple frameworks, managing milestones, dependencies, risks, and stakeholder reporting to GRC leadership
- Planning and executing quarterly audits from scoping through report and findings closeout
- Conducting audit readiness activities including control owner preparation, evidence pre-checks, and walkthrough dry runs
- Scoping audit boundaries with Product and Engineering teams to determine which products and deployment paths are in scope
- Building and maintaining the audit operating model and runbook for a unified program
- Driving automation across the program so evidence is collected once and reused across frameworks, reducing effort each cycle
- Coordinating audits across frameworks and firms to align audit windows and consolidate control owner requests
- Planning new audits and audit expansions as the company commits to new frameworks or regions
- Running framework and scope expansion evaluations and gap assessments with recommendations and effort estimates for leadership
- Managing relationships with control owners, GRC Partners, and external auditors
- Reporting audit status, findings, and program metrics to GRC leadership
The role involves working with external audit firms, GRC Partners, and control owners across the company. You'll help build the audit operating model and runbook, and drive automation using Claude and other tools to make the program simpler and more efficient each cycle. This is an individual contributor role for someone with strong program management experience who writes clearly, stays calm under deadline pressure, and excels at simplifying complex programs.
REQUIREMENTS:
- Several years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and status reporting to leadership
- Several years running external security audits (SOC 2 and ISO 27001 minimum) on the company side or at an audit firm, including managing multiple frameworks simultaneously
- Working knowledge of SOC 2, ISO 27000 family, ISO 42001, and HIPAA, including understanding of overlapping requirements
- Experience leading gap assessments for new frameworks or scope changes and presenting results to leadership
- Experience building or improving audit processes including calendars, request tracking, runbooks, roles and responsibilities
- Technical fluency sufficient to understand how evidence is produced in cloud environments and to judge whether system-generated reports are complete and accurate; ability to build simple automations with Claude
- Clear writing skills and ability to coordinate calmly under deadline pressure
- Ability to get control owners to deliver on time without direct authority over them
- Bachelor's degree or equivalent combination of education, training, and professional experience in a field relevant to the role
PREFERRED QUALIFICATIONS:
- Audit firm experience (Big 4 or SOC 2/ISO certification body), especially as senior or manager on technology clients
- Experience adding new frameworks such as PCI DSS, ISO 27701, ISO 27018, CSA STAR, or international schemes (IRAP, ISMAP, C5)
- Experience automating evidence collection or audit reporting, or using Claude/LLMs daily for program planning, tracking, and reporting
- Experience with GRC platforms or building lightweight internal tooling
- Certifications such as CISA, CISSP, or ISO 27001 Lead Auditor (welcome but not required)
- Prior AI industry experience is not required
