Security Risk and Compliance, Agent Security

Responsibilities:

• Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated
• Define review and approval criteria when an agent may interact with sensitive or regulated data, and which actions require human approval as it relates to compliance frameworks
• Serve as the GRC reviewer within existing engineering approval workflows
• Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data
• Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional security, research and engineering teams
• Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act), strengthening Anthropic's certification efforts ensuring agent security is auditable
• Assess and document agent-related security and compliance risks, driving them to resolution with engineering owners
• Own the policy for agent-related risk acceptances and exceptions, including approval authority, duration and re-review

You may be a good fit if you:

• Have 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
• Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries
• Think about non-human identities as a distinct risk and control category, and can design least-privilege access and accountability controls for systems acting on a person's behalf
• Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor
• Have defined risk-based review or approval criteria within engineering workflows and kept them effective under high change velocity
• Deliver clear, precise written work for both technical and non-technical audiences
• Thrive in ambiguous environments with no settled industry playbook, where you're expected to propose the standard rather than wait for one
• Are energized by being the security and risk authority who educates and influences outcomes rather than only advises

Strong candidates may also:

• Understand the security properties of LLM agents, whether from an AI, developer-platform, or agent-tooling company, or through comparable experience
• Bring familiarity with AI governance frameworks alongside traditional security frameworks
• Have adapted controls from regulated or highly sensitive environments to an open, high-trust engineering culture
• Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor)

Candidates need not have:

• Done everything on this list before. Very few people have governed AI agents at scale we care more about how you reason about access, accountability, and blast radius than about a prior title.