Staff+ Software Engineer, GRC Platform
Build the GRC platform at Anthropic by designing data pipelines, integrations, and agentic LLM workflows that automate compliance evidence collection, policy-as-code, and real-time risk reporting across cloud, identity, HR, and CI/CD systems.
About the job
Key Responsibilities
- Design and build data pipelines that aggregate risk, control, and asset information from across Anthropic's technology stack, solving hard integration problems like disparate schemas, inconsistent data quality, and unified views of posture
- Build and maintain integrations connecting our platform to cloud infrastructure, identity management, HRIS, ticketing, version control, and CI/CD systems to enable automated evidence collection and continuous validation
- Translate written policies and regulatory requirements into policy-as-code, turning static documents and spreadsheets into enforceable rules, automated checks, and continuous monitoring
- Design and deploy agentic workflows where Claude handles work that previously required manual effort, such as analyzing evidence, generating audit responses, and monitoring control effectiveness
- Develop dashboards and reporting that provide real-time visibility into risk and compliance posture for audiences ranging from engineers to executives and external auditors
- Make architectural decisions that shape how the platform grows, establishing patterns and tooling that other engineers will build on
- Partner with Security, IT, Infrastructure, and product engineering teams to make controls and evidence collection native to how Anthropic builds and ships
- Operate what you build, owning reliability and data integrity for systems that audits and executive reporting depend on
Minimum Qualifications
- 8+ years of experience building backend systems, data pipelines, or internal platforms that other teams depend on, ideally operating at tech lead level
- Systems thinker who understands how data flows between systems, where the integration points are, and what breaks when systems don't talk to each other
- Depth in either integration engineering (REST APIs, webhooks, authentication flows, event-driven architectures) or data infrastructure (warehousing, ELT/ETL, orchestration), and fluency in the other
- Proficient in Python, Go, or similar languages, and have production experience with cloud platforms (AWS, GCP, or Azure) and infrastructure-as-code
- High bar for data quality and reliability, and enjoy turning ambiguous, manual processes into simple, reliable automated systems
- Take full ownership of your work, from design through deployment and operations, and can navigate ambiguity and make sound technical decisions independently
- Product-focused approach to platform work and care about building tools internal customers love to use
- Excited to build with LLMs as system components, designing agentic workflows, evaluating their outputs, and making them reliable enough for high-stakes use
Preferred Qualifications
- Experience in domains where engineering meets regulation, such as privacy engineering, data governance, fintech, healthcare, or trust and safety
- Experience designing and shipping LLM-based or agentic automation in production or operational contexts
- Familiarity with compliance frameworks (SOC 2, ISO 27001, HIPAA, FedRAMP) or GRC platforms (ServiceNow, Vanta, Drata, OneTrust)
- Prior experience at high-growth startups, building processes and systems that scale
Skills
Python, Go, AWS, GCP, Azure, REST APIs, Webhooks, Event-Driven Architectures, ELT, ETL, Infrastructure-As-Code, LLMs
Similar jobs
Security Engineering jobs
Gusto
San Francisco, CA
Own and scale IT general controls, access governance, segregation of duties, and audit readiness across enterprise applications. The role combines SOX expertise with AI-enabled continuous controls monitoring and requires 10+ years of controls, audit, or enterprise governance experience.
Harvey
San Francisco, CA
Staff Security Software Engineer leading identity and access strategy, architecture, and hands-on platform development across customer, employee, contractor, and agentic identities. Requires 10+ years of production software experience and deep expertise in identity and authorization systems.
United States
Design and operate distributed, low-latency infrastructure that protects Reddit from DDoS attacks, bots, scraping, and other network threats. The role requires 7+ years of distributed-systems experience plus expertise in security, networking, and production operations.
Upside
Washington, DCStaff-level AppSec engineer building secure coding practices and vulnerability management for a commerce platform. Requires 6+ years in application security with deep AWS and Python experience.
Lob
United States
Own the technical security function across cloud infrastructure, detection and response, application security, incident response, and automation. The role requires 8+ years of security engineering experience, deep AWS expertise, and the ability to lead security improvements across engineering teams.