Third Party Risk Analyst, Security GRC

<div class="content-intro"><h2><strong>About Anthropic</strong></h2> <p>Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.</p></div><h2><strong>About the role</strong></h2> <p>Anthropic's Third Party Risk Management (TPRM) team sits within Security GRC and is responsible for risk management of our vendor and partner relationships, making risk visible to the people who need to act on it, and driving it down. We're building the program for what a frontier AI lab actually has at stake: the models, the research IP, the safety commitments, and the infrastructure that keeps Claude available to customers. The program is designed agent-first, with an AI risk agent handling intake, tiering, and evidence collection so that people spend their time on judgment, remediation, and the vendors that matter most.</p> <p>This role owns the top of that risk stack. You will run the Mission Critical and Highest-Risk vendor portfolios. On the Mission Critical side that means the compute, data center, and data-pipeline vendors where a tier rating is the start of the conversation rather than the end of it: exit and failover planning, single-point-of-failure analysis and treatment, and financial and solvency screening. On the Highest-Risk side that means the vendors with the deepest access to our data and systems, where you'll make sure assessment depth matches the exposure and drive remediation on what those assessments surface. You'll also carry the operational baseline the whole team shares (intake reviews, QA on agent output, escalations, reporting) so the program keeps moving while the portfolio work is underway.</p> <h2><strong>Key responsibilities</strong></h2> <ul> <li>Own the Mission Critical vendor portfolio: maintain the tiered list, validate it against business impact analysis findings, support exit and failover planning, and drive risk treatment for single points of failure with Procurement, Business Continuity, and business owners</li> <li>Manage the Highest-Risk vendor portfolio: keep security, privacy, and compliance assessment depth aligned to active vendor exposure, and drive remediation with the relevant domain teams</li> <li>Support vendor incident response: vendor-side impact assessment, business-owner coordination, and post-incident risk treatment</li> <li>Run inherent risk assessments through the intake workflow: review agent-prefilled tiering, evaluate vendor controls and evidence across security, privacy, compliance, and operational risk, determine residual risk, and route to domain reviewers where deeper assessment is warranted</li> <li>Operate the TPRM issue management workflow: document findings with clear risk statements, assign owners, track treatment to closure</li> <li>Tune and maintain the TPRM Risk Agent alongside the team through prompt development, backtest calibration, error analysis, and output QA</li> <li>Contribute to KPI/KRI reporting on portfolio coverage and cycle time</li> </ul> <h2><strong>Minimum qualifications</strong></h2> <ul> <li>Experience running third party or vendor risk assessments end to end at a technology company: scoping the engagement, determining inherent risk, reviewing controls and evidence, documenting residual risk, and driving findings to closure</li> <li>Working knowledge of risk fundamentals (inherent and residual risk, control effectiveness, compensating controls, risk acceptance) and the judgment to apply them when the evidence is incomplete or the answer isn't in a framework</li> <li>Ability to assess a vendor across security, privacy, compliance, and operational risk domains, and to recognize which findings you can close yourself and which need a domain specialist</li> <li>Track record of driving risk treatment to closure through influence across teams with competing priorities</li> <li>Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including tuning prompts and reviewing model output for accuracy</li> <li>Experience building or operating issue management workflows: logging issues with a clear owner and due date, tracking remediation, and escalating when treatment stalls</li> <li>Hands-on time in a procurement or GRC platform with an understanding of how intake, tiering, and assessment routing fit together</li> <li>Working knowledge of business continuity, disaster recovery, and concentration risk concepts, with the ability to apply them to a vendor portfolio</li> </ul> <h2><strong>Preferred qualifications</strong></h2> <ul> <li>Experience assessing cloud infrastructure, data center, or data-pipeline vendors</li> <li>Experience with vendor financial health or solvency screening (credit models, financial statement review, or tools such as RapidRatings, CreditSafe, or LSEG)</li> <li>Experience supporting SOX, SOC 2, or ISO 27001 third party or vendor management controls</li> <li>Exposure to exit planning, contract termination provisions, or supplier failover testing</li> </ul><div class="content-pay-transparency"><div class="pay-input"><div class="description"><p>The annual compensation range for this role is listed below.&nbsp;</p> <p>For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.</p></div><div class="title">Annual Salary:</div><div class="pay-range"><span>$255,000</span><span class="divider">&mdash;</span><span>$270,000 USD</span></div></div></div><div class="content-conclusion"><h2><strong>Logistics</strong></h2> <p><strong>Minimum education: </strong>Bachelor’s degree or an equivalent combination of education, training, and/or experience</p> <p><strong>Required field of study:&nbsp;</strong>A field relevant to the role as demonstrated through coursework, training, or professional experience</p> <p><strong>Minimum years of experience: </strong>Years of experience required will correlate with the internal job level requirements for the position</p> <p><strong>Location-based hybrid policy:</strong> Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.</p> <p><strong data-stringify-type="bold">Visa sponsorship:</strong>&nbsp;We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.</p> <p><strong>We encourage you to apply even if you do not believe you meet every single qualification.</strong> Not all strong candidates will meet every single qualification as listed.&nbsp; Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.<br><br><strong data-stringify-type="bold">Your safety matters to us.</strong> To protect yourself from potential scams, remember that Anthropic recruiters only contact you from&nbsp;@anthropic.com&nbsp;email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information bef