SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 255,000 - 270,000 / annual
Anthropic's Security Governance, Risk, and Compliance (GRC) team is seeking a senior compliance specialist to own US public sector authorization programs. This individual contributor role sits within the Compliance & Audit Programs (CAP) team and manages the full lifecycle of federal civilian (FedRAMP, FedRAMP 20x for Claude Enterprise), Department of War (DoD impact levels, CMMC, NIST SP 800-171), and state/local (StateRAMP, TX-RAMP) authorizations.
You will drive recurring compliance cycles including continuous monitoring, Plans of Action & Milestones (POA&M), annual assessments, and significant change management. You'll translate government requirements into specific, testable engineering requirements, review evidence of control implementation, and make go/no-go decisions on government boundary launches. You'll maintain the mapping between US government requirements and Anthropic's Common Control Framework, ensuring a single source of truth across the integrated audit view.
Key responsibilities include: running recurring compliance cycles for current authorizations (starting with C4G on Palantir FedStart and NIST SP 800-171 assessments with Schellman); co-owning FedRAMP 20x for Claude Enterprise and building new authorizations (first-party FedRAMP High, DoD impact levels, StateRAMP, TX-RAMP); supporting model authorizations in GovCloud and Vertex for every model launch as the GRC member of the Inference and model delivery pod; translating government obligations into partner team requirements (e.g., vulnerability SLAs); answering public sector customer and deal questions on compliance boundaries, CUI, IRS Publication 1075, CJIS, and ITAR; mapping government requirements to the Common Control Framework; and using Claude to automate mapping, evidence collection, and reporting while maintaining human judgment in the loop.
This role works closely with a peer on US public sector compliance and requires someone who works independently, writes clearly, and finds satisfaction in authorizations that remain robust as products evolve.
REQUIREMENTS:
- Several years in security compliance or IT audit with hands-on US government compliance experience for a cloud service (FedRAMP, DoD impact levels, CMMC, NIST SP 800-171, or StateRAMP), including the ongoing compliance cycle post-authorization
- Working command of NIST SP 800-53 Moderate baseline and authorization mechanics: boundary definition, control implementation statements, assessment, continuous monitoring, POA&M, and significant change management
- Experience writing requirements for engineering teams from a control baseline and reviewing returned evidence
- Working knowledge of GovCloud or Vertex-style government regions and how model/feature/region additions affect authorized boundaries
- Technical fluency sufficient to read runbooks, configurations, or pipeline definitions and assess control enforcement
- Clear writing skills (implementation statements and status reports are used by assessors, engineers, and leadership)
- Ability to drive partner team prioritization and closure of compliance work without direct authority
- Bachelor's degree or equivalent combination of education, training, and professional experience in a field relevant to the role
PREFERRED QUALIFICATIONS:
- Experience taking a service through FedRAMP High, DoD IL4/IL5, or supporting classified network services
- FedRAMP 20x pilot participation or machine-readable evidence/reporting for assessors
- Applied LLMs to compliance work (control mapping, evidence testing, continuous evidence collection)
- US security clearance eligibility or current clearance
- State and local compliance experience (StateRAMP, TX-RAMP, IRS Publication 1075, CJIS)
NOTE: You do not need to have done everything on this list, worked every regime, written production code (fluency to read and challenge suffices), or hold every certification (CISSP, CISA, CGRC welcome but not required). Prior AI industry experience is not required.
