Security Risk and Compliance, Agent Security

Responsibilities: - Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated - Define review and approval criteria when an agent may interact with sensitive or regulated data, and which actions require human approval as it relates to compliance frameworks - Serve as the GRC reviewer within existing engineering approval workflows - Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data - Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional security, research and engineering teams - Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act), strengthening Anthropic's certification efforts ensuring agent security is auditable - Assess and document agent-related security and compliance risks, driving them to resolution with engineering owners - Own the policy for agent-related risk acceptances and exceptions, including approval authority, duration and re-review ## You may be a good fit if you: - Have 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company - Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries - Think about non-human identities as a distinct risk and control category, and can design least-privilege access and accountability controls for systems acting on a person's behalf - Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor - Have defined risk-based review or approval criteria within engineering workflows and kept them effective under high change velocity - Deliver clear, precise written work for both technical and non-technical audiences - Thrive in ambiguous environments with no settled industry playbook, where you're expected to propose the standard rather than wait for one - Are energized by being the security and risk authority who educates and influences outcomes rather than only advises ## Strong candidates may also: - Understand the security properties of LLM agents, whether from an AI, developer-platform, or agent-tooling company, or through comparable experience - Bring familiarity with AI governance frameworks alongside traditional security frameworks - Have adapted controls from regulated or highly sensitive environments to an open, high-trust engineering culture - Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor) ## Candidates need not have: - Done everything on this list before. Very few people have governed AI agents at scale we care more about how you reason about access, accountability, and blast radius than about a prior title.