# Lead, Security Controls Assurance - SOX

**Company:** [Anthropic](https://hotfix.jobs/companies/anthropic)
**Location:** San Francisco, CA, Seattle, WA, New York, NY, Washington, DC
**Role:** Security Engineering
**Salary:** $410k – $510k/yr
**Skills:** Sox 404, Itgc, Pcaob As 2201, Coso 2013, Terraform, CI/CD, Python, Go, Rust, C++, Cloud Infrastructure, SOC 2, ISO 27001, Continuous Monitoring, LLMs
**Posted:** 2026-09-08

> Leads technical SOX controls assurance for financially significant systems, translating audit requirements into engineering acceptance criteria and continuous monitoring. Requires ITGC and SOX 404 expertise, strong engineering fluency, programming ability, and cross-functional collaboration with Finance, Engineering, and auditors.

## Job Description

## Responsibilities
- Define control requirements and acceptance criteria across IT general control domains: logical access, change management, computer operations, and program development for SOX in-scope systems.
- Establish auditability, segregation of duties, change control, immutable logging, and evidence-retention requirements for financially significant systems before go-live.
- Review infrastructure, system, and agent-framework changes for SOX impact, including changes to scope, key control populations, and evidence requirements.
- Own second-line control monitoring and evidence readiness, including continuous controls monitoring, automated evidence collection, control testing, walkthrough preparation, population and completeness validation, and controls-framework mapping.
- Drive root-cause analysis and remediation of ITGC deficiencies with engineering, Internal Audit, and external-audit partners; assess remediation effectiveness before retesting.
- Assess the control-design, evidence, and engineering impact of new products, entities, systems, and integrations entering SOX scope.
- Align SOX ITGCs with SOC 2, ISO 27001/42001, and other compliance frameworks so controls and evidence are designed and maintained efficiently.

## Requirements
- Experience leading or making senior contributions to an ITGC program through SOX 404 readiness and/or at a public company.
- Working knowledge of PCAOB AS 2201, COSO 2013, and external-auditor technology-control scoping, testing, and deficiency evaluation.
- Engineering fluency, including the ability to read code and Terraform, follow CI/CD pipelines, and assess technical designs.
- Programming experience in Python or a systems language such as Go, Rust, C, or C++.
- Familiarity with developer platforms, release engineering, cloud infrastructure, or ERP and financial-systems controls.
- Understanding of second-line assurance responsibilities and the distinction between monitoring and Internal Audit’s independent testing.
- Strong collaboration and communication across Finance, Engineering, Internal Audit, and external auditors.
- Experience using Claude or other LLMs as working tools and evaluating appropriate AI applications for SOX assurance.
- Bachelor’s degree or equivalent combination of education, training, and experience.

## Nice-to-haves
- Big Four or equivalent audit/advisory experience, ideally in IT audit, combined with in-house experience at an AI-focused technology company.
- Experience with first-year SOX 404(a) and 404(b) assessments, including a first external ITGC audit.
- Experience defining or assessing controls for home-built financially significant systems, usage-based billing, or revenue-metering pipelines.
- Experience defining or assessing controls for AI/ML systems or production agents.
- Experience establishing continuous controls monitoring or automated evidence programs.
- Experience with SOC 1 reliance, service-organization control mapping, and complementary user-entity controls.
- CISSP, CISA, CPA, or equivalent certification.

## Compensation
- Annual salary: **$410,000–$510,000 USD**.

## Similar jobs

- [Security GRC Lead](https://hotfix.jobs/jobs/2eb261b0-5ff9-435d-b0fb-eaf5933051d1) - Mercor - San Francisco, CA - $350k – $425k/yr
- [Platform Security Engineer, DRTM / Secure Launch](https://hotfix.jobs/jobs/52321fb7-76c2-4b9b-b900-53a63bb68154) - Anthropic - San Francisco, CA - $320k – $405k/yr
- [Safeguards Enforcement Lead, Cyber Harms](https://hotfix.jobs/jobs/c042fb99-fa5c-4740-9908-e14324222bde) - Anthropic - Washington, DC - $285k – $330k/yr
- [Software Security Architect, Operating Systems | Consumer Devices](https://hotfix.jobs/jobs/eae7f6bf-7cf9-495a-9c46-fb88a4620a0f) - OpenAI - San Francisco, CA - $268k – $342k/yr
- [Cyber Operations Lead, Critical Harm Operations](https://hotfix.jobs/jobs/aece8b0b-4900-4762-87e1-025b2cbe75c9) - OpenAI - San Francisco, CA - $252k – $335k/yr

**Apply:** https://hotfix.jobs/jobs/a1c11627-c920-4e31-abc6-2e170042a626
**Canonical:** https://hotfix.jobs/jobs/a1c11627-c920-4e31-abc6-2e170042a626