Lead - Security Controls Assurance - SOX

The role

You will define control requirements and acceptance criteria for IT general controls to support SOX 404 compliance. You will partner with engineering to design and implement controls and manage continuous control monitoring.

What you will do

• Define control requirements and acceptance criteria across core ITGC domains for SOX in-scope systems.
• Set requirements for auditability, segregation of duties, and change control for new systems.
• Review infrastructure and system changes for SOX impact during design.
• Own second-line control monitoring and automated evidence collection for ITGCs.
• Drive control deficiency remediation with cross functional partners.
• Assess scope changes through a SOX lens for new products and systems.
• Maintain alignment with SOC 2, ISO 27001/42001, and other frameworks.

Required qualifications

• Thrive at the pace of a hypergrowth company.
• Led or been a senior contributor to an ITGC program through SOX 404 readiness and/or at a public company.
• Working command of PCAOB AS 2201 and COSO 2013.
• Engineering fluency including reading code and Terraform and following CI/CD pipelines.
• Programming skills in Python or at least one systems language such as Go, Rust, or C/C++.
• Deep familiarity with developer platform, release engineering, cloud infrastructure, or ERP/financial systems control domains.
• Understand the role of the second line.
• Strong collaborator and communicator across Finance, Engineering, Internal Audit, and external auditors.
• Use Claude and other LLMs as daily working tools.
• Translate SOX and framework language into acceptance criteria for engineers.
• Bachelor’s degree or an equivalent combination of education, training, and/or experience.
• Field of study relevant to the role as demonstrated through coursework, training, or professional experience.

Nice to have

• Combination of audit or advisory experience (Big 4 or equivalent, ideally IT audit) with in-house experience at an AI-forward tech company.
• Taken a company through a first-year SOX 404(a) and 404(b) assessment.
• Defined or assessed controls over home-built financially significant systems, usage-based billing, or revenue metering pipelines.
• Defined or assessed controls for AI/ML systems or agents acting in production environments.
• Stood up continuous controls monitoring or automated evidence programs.
• Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls.
• CISSP, CISA, CPA, or equivalent certification.

Benefits

• Competitive compensation and benefits
• Optional equity donation matching
• Generous vacation and parental leave
• Flexible working hours
• Office space

Before you apply

• We do sponsor visas, though not for every role or candidate.

About the company

Anthropic is a public benefit corporation headquartered in San Francisco. Its mission is to create reliable, interpretable, and steerable AI systems.