Third Party Risk Analyst, Security GRC
About the role
The Third Party Risk Management (TPRM) team at Anthropic is responsible for managing risks associated with vendor and partner relationships. This role focuses on the top of the risk stack, owning the Mission Critical and Highest-Risk vendor portfolios.
Responsibilities
Own the Mission Critical vendor portfolio: Maintain the tiered list, validate it against business impact analysis findings, support exit and failover planning, and drive risk treatment for single points of failure with Procurement, Business Continuity, and business owners.
Manage the Highest-Risk vendor portfolio: Keep security, privacy, and compliance assessment depth aligned to active vendor exposure, and drive remediation with the relevant domain teams.
Support vendor incident response: Vendor-side impact assessment, business-owner coordination, and post-incident risk treatment.
Run inherent risk assessments through the intake workflow: Review agent-prefilled tiering, evaluate vendor controls and evidence across security, privacy, compliance, and operational risk, determine residual risk, and route to domain reviewers where deeper assessment is warranted.
Operate the TPRM issue management workflow: Document findings with clear risk statements, assign owners, track treatment to closure.
Tune and maintain the TPRM Risk Agent alongside the team through prompt development, backtest calibration, error analysis, and output QA.
Contribute to KPI/KRI reporting on portfolio coverage and cycle time.
Requirements
Experience running third party or vendor risk assessments end to end at a technology company: scoping the engagement, determining inherent risk, reviewing controls and evidence, documenting residual risk, and driving findings to closure.
Working knowledge of risk fundamentals (inherent and residual risk, control effectiveness, compensating controls, risk acceptance) and the judgment to apply them when the evidence is incomplete or the answer isn't in a framework.
Ability to assess a vendor across security, privacy, compliance, and operational risk domains, and to recognize which findings you can close yourself and which need a domain specialist.
Track record of driving risk treatment to closure through influence across teams with competing priorities.
Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including tuning prompts and reviewing model output for accuracy.
Experience building or operating issue management workflows: logging issues with a clear owner and due date, tracking remediation, and escalating when treatment stalls.
Working knowledge of business continuity, disaster recovery, and concentration risk concepts, with the ability to apply them to a vendor portfolio.
Qualifications
Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience.
Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience.
Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position.
Pay
The annual compensation range for this role is $255,000—$270,000 USD.
Schedule
Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Benefits
We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.