SOX ITGC Controls Lead — Continuous Assurance

Anthropic Limited; New York (NY); On-site; USD 410,000 - 510,000; Full time

Job summary

Anthropic is seeking a Security GRC professional to own IT general controls design and continuous monitoring for SOX 404 compliance across its engineering stack. You will define control requirements, collaborate with Internal Audit, and ensure evidence readiness.

You will lead second-line monitoring, drive remediation with cross-functional partners, and align controls with SOC 2 and ISO 27001 frameworks while leveraging AI tools.

Qualifications

• Thrive at the pace of a hypergrowth company and adapt to shifting scope.
• Have led or been a senior contributor to an ITGC program through SOX 404 readiness and/or at a public company, with a working command of PCAOB AS 2201, COSO 2013, and how external auditors scope, test, and evaluate technology controls and deficiencies.
• Have genuine engineering fluency: read code and Terraform, follow a CI/CD pipeline end to end, and challenge a design on its technical merits.
• Have programming skills in Python or at least one systems language such as Go, Rust, or C/C++.
• Deep familiarity with developer platform, release engineering, cloud infrastructure, or ERP/financial systems control domains.
• Understand the role of the second line: advise and challenge engineering without ownership of their controls, and know the line between monitoring and Internal Audit testing.
• Strong collaborator across Finance, Engineering, Internal Audit, and external auditors.
• Translate SOX and framework language into acceptance criteria engineers can build against, and translate engineering reality into assurance language auditors rely on.

Responsibilities

• Define control requirements and acceptance criteria across core ITGC domains (logical access, change management, operations, and development) for SOX in-scope systems.
• Set the bar for in-scope systems from day one, defining auditability, segregation of duties, change control, immutable logging, and evidence retention before go-live.
• Pressure-test changes for SOX impact during design and assess scope changes with a SOX lens.
• Own second-line control monitoring and evidence readiness; stand up continuous controls monitoring and automated evidence collection for ITGCs.
• Drive control deficiency remediation with cross-functional partners and assess remediation before re-testing.
• Maintain alignment with broader compliance portfolios (SOX, SOC 2, ISO 27001/42001) and ensure frameworks do not conflict.

Skills

Python

Go

Rust

C/C++

CI/CD

Cloud infrastructure

Education

Bachelor's degree

COSO 2013 knowledge

PCAOB AS 2201 knowledge

Tools

Terraform

CI/CD pipelines

Job description

Anthropic is seeking a Security GRC professional to own IT general controls design and continuous monitoring for SOX 404 compliance across its engineering stack. You will define control requirements, collaborate with Internal Audit, and ensure evidence readiness.

You will lead second-line monitoring, drive remediation with cross-functional partners, and align controls with SOC 2 and ISO 27001 frameworks while leveraging AI tools.