Vendor Risk & GRC Analyst (Third-Party Security)

Anthropic; San Francisco (CA); On-site; USD 255,000 - 270,000; Full time

Benefits offered by this job

Competitive compensation

Equity options

Flexible hours

SF office access

Job summary

Anthropic is seeking a Senior Third Party Risk Manager to lead the top tier of vendor risk, including mission-critical compute, data center, and data-pipeline partners. You will shape risk assessments, escalation, and remediation across security, privacy, and operations.

You’ll own intake reviews, tiering, and evidence collection, ensuring alignment with domain teams and business continuity plans. Hybrid SF-office role with visa sponsorship support.

Qualifications

• Experience running third party/vendor risk assessments end to end at a tech company.
• Ability to apply risk fundamentals (inherent vs residual) when evidence is incomplete.
• Ability to assess vendors across security, privacy, compliance, and operational risk domains.

Responsibilities

• Own the Mission Critical vendor portfolio with tiered risk management.
• Manage Highest-Risk vendor portfolio and drive remediation with domain teams.
• Support vendor incident response and post-incident risk treatment.
• Run inherent risk assessments through intake and determine residual risk.
• Operate the TPRM issue management workflow and track remediation to closure.
• Tune and maintain the Risk Agent, QA outputs and backtests.
• Contribute to KPI/KRI reporting on portfolio coverage.

Skills

Vendor risk assessments

Security & privacy risk

Influence across teams

Procurement & GRC workflow

LLM-backed workflow

Issue management

Risk assessment routing

Education

Bachelor’s degree or equivalent

Tools

GRC platform

Procurement system

Risk assessment tooling

Job description

Anthropic is seeking a Senior Third Party Risk Manager to lead the top tier of vendor risk, including mission-critical compute, data center, and data-pipeline partners. You will shape risk assessments, escalation, and remediation across security, privacy, and operations.

You’ll own intake reviews, tiering, and evidence collection, ensuring alignment with domain teams and business continuity plans. Hybrid SF-office role with visa sponsorship support.