SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 255,000 - 345,000 / annual
Anthropic is seeking a Security Risk & Compliance professional to lead governance of AI agents within the company's Security Governance, Risk, and Compliance (GRC) team. This role is critical to translating regulatory, customer, and voluntary security obligations into actionable controls and providing leadership visibility into compliance performance.
You will serve as the security policy partner for AI agent governance, authoring policies and standards for how agents are built, deployed, and operated. Key responsibilities include:
• Author security policies and standards for AI agent development, deployment, and operations
• Define review and approval criteria for agents interacting with sensitive or regulated data, including which actions require human approval
• Serve as the GRC reviewer within existing engineering approval workflows
• Establish data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated/sensitive data
• Monitor agent behavior over time and adapt governance requirements in partnership with security, research, and engineering teams
• Map agent security and data controls to AI governance frameworks (ISO 27001, ISO 42001, EU AI Act) to strengthen certification efforts and ensure auditability
• Assess and document agent-related security and compliance risks, driving resolution with engineering owners
• Own policies for agent-related risk acceptances and exceptions, including approval authority, duration, and re-review cycles
Anthropic is building toward a fundamentally different kind of GRC that leverages AI (Claude) with appropriate human oversight to continuously challenge and evidence control performance, rather than relying solely on periodic audits.
The team values clear communication with both technical and non-technical audiences, the ability to reason from threat models to controls, and the capacity to propose standards in emerging areas where industry playbooks do not yet exist.
REQUIREMENTS:
• 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
• Demonstrated experience compartmentalizing sensitive data, PII, or intellectual property; deep understanding of how identity and access mechanisms implement or undermine protection boundaries
• Ability to think about non-human identities as a distinct risk and control category; capability to design least-privilege access and accountability controls for systems acting on behalf of individuals
• Ability to reason from threat models to controls and explain tradeoffs to both engineers and auditors
• Experience defining risk-based review or approval criteria within engineering workflows and maintaining their effectiveness under high change velocity
• Strong written communication skills for both technical and non-technical audiences
• Comfort thriving in ambiguous environments with no settled industry playbook; expectation to propose standards rather than wait for them
• Preference for being a security and risk authority who educates and influences outcomes rather than only advising
STRONG ADDITIONAL QUALIFICATIONS:
• Understanding of security properties of LLM agents (from AI, developer-platform, or agent-tooling company experience, or comparable background)
• Familiarity with AI governance frameworks alongside traditional security frameworks
• Experience adapting controls from regulated or highly sensitive environments to open, high-trust engineering cultures
• Relevant certifications: CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor
Minimum education: Bachelor's degree or equivalent combination of education, training, and professional experience in a field relevant to the role.
Hybrid arrangement: Currently expect all staff in office at least 25% of the time; some roles may require more.
