Continuous Controls Auditor & GRC Lead

Alex Loftus; New York (NY); Hybrid; USD 140,000 - 230,000; Full time

Job summary

Anthropic is seeking an experienced Security Audit & Controls professional to own the Common Control Framework across all control domains, including access, change management, logging, encryption, and people controls. You will map controls to frameworks, draft descriptions, and drive evidence-driven monitoring with control owners and GRC partners.

You’ll build operational effectiveness, verify remediation, and advance audit-ready evidence across multiple regulations.

Qualifications

• At least a Bachelor's degree in a related field or equivalent experience.
• 5+ years in IT audit, security compliance, or controls assurance.
• Experience with multiple control frameworks (SOC 2, ISO 27001, FedRAMP, HIPAA).
• Ability to draft control descriptions, activities and test procedures.
• Experience with continuous controls monitoring or automated evidence collection.
• Clear writing and ability to map frameworks to controls.

Responsibilities

• Own the Common Control Framework and its mappings to SOC 2, ISO 27001/4, HIPAA, FedRAMP, and customer commitments.
• Draft and validate control descriptions and activities with control owners.
• Design and run continuous monitoring of control efficacy and evidence testing.
• Verify remediation and carry it into steady state with GRC Partners.
• Map new frameworks onto the CCF and support gap assessments.
• Support integrated and customer audits, readiness checks, and evidence requests.
• Evaluate evidence reliability and auditor-readiness across systems.
• Build with Claude to automate mapping, testing and monitoring.

Skills

Audit & GRC knowledge

Framework mapping

Control description drafting

Continuous controls monitoring

Evidence evaluation

Clear technical writing

Stakeholder collaboration

AI/LLM awareness

Education

Bachelor's degree in related field

Job description

Anthropic is seeking an experienced Security Audit & Controls professional to own the Common Control Framework across all control domains, including access, change management, logging, encryption, and people controls. You will map controls to frameworks, draft descriptions, and drive evidence-driven monitoring with control owners and GRC partners.

You’ll build operational effectiveness, verify remediation, and advance audit-ready evidence across multiple regulations.