Staff+ Software Security Engineer
About the role
Scope, design, and build complex security systems end to end, maintaining them through production and driving through ambiguous technical challenges with minimal oversight
Identify systematic risks through threat modeling and risk assessment, then build the controls and infrastructure that address them
Mentor engineers across the security team and broader engineering organization, contribute to hiring, and grow security engineering culture at Anthropic
Enable other teams to build their own security solutions by providing design pattern guidance and expanding security ownership beyond the security team
Developer security and supply chain
Build and advance our developer security program by embedding security practices into the software development lifecycle and developer workflows
Harden CI/CD pipelines against supply chain attacks through isolated build environments, signed attestations, dependency verification, and automated policy enforcement
Identity and secrets management
Architect systems that protect sensitive assets including model weights, customer data, and training datasets
Build and operate credential issuance, rotation, and workload authentication across our multi-cloud environments
Infrastructure security
Implement and maintain cloud security controls including IAM, network segmentation, VPC architecture, and encryption across our multi-cloud and on-prem environments
Contribute to cluster security controls including RBAC policies, namespace isolation, workload identity, and pod security
Contribute to continuous cloud security posture management using infrastructure-as-code scanning, misconfiguration detection, and automated remediation
Secure frameworks
Build critical security foundations including cryptographic frameworks, mTLS infrastructure, secure serialization, and authorization systems, designed to prevent entire classes of vulnerabilities and empower engineering teams to work securely without becoming security experts themselves
Partner with product, research, infrastructure, and other security teams to ensure frameworks integrate smoothly with lower-layer security controls