Staff / Senior Data Center Security Engineer

Overview

Own one or more data center security domains end to end for Anthropic's compute footprint, designing the controls and building the systems that enforce and verify them, and setting the technical standard for partners to build to.

What you'll do

• Own one or more security domains end to end: physical security at partner-operated and Anthropic-operated sites, hardware supply chain and chain of custody, media protection and sanitization, personnel security and site access, third-party and vendor security assessment, and maintenance and contingency controls.
• Build internal tools, automation and AI agents the team runs on, including evidence collection, access reviews, asset and custody tracking, and partner intake.
• Perform security review for new sites, leases and vendors: find gaps in design, contract and operator procedures, write security terms and exhibits, and verify fixes after signing.
• Write requirements and procedures that a partner can build to and an assessor can test, kept as code in a version-controlled repository.
• Assess sites and suppliers against those requirements, on site and from evidence; document deviations and engineer compensating controls where a requirement cannot be met as written.
• Tie controls to the compliance frameworks Anthropic and its partners are assessed against, keeping evidence current so assessments pull from it directly.
• Respond to security events at sites (intrusion alarms, custody breaks, access violations) with operations teams and site operators, write up what happened, and fix the control that allowed it.

What you'll need

• Have engineered a security control domain end to end: designed the controls, built or integrated the systems that enforce them, and verified they work.
• Read and review code, design the data systems behind security tooling, and build automation (often with AI coding agents) using Git and code review.
• Have done security work hands-on for data centers, critical infrastructure or a large hardware fleet, in at least one of the domains listed above.
• Have applied a control framework such as NIST SP 800-53, ISO 27001 or SOC 2 to real systems and produced the evidence for it.
• Write requirements a third party can build to and an assessor can test: each states what must be true, how it is verified and what evidence shows it.
• Bachelor's degree or an equivalent combination of education, training, and/or experience.
• A field relevant to the role as demonstrated through coursework, training, or professional experience.

Nice to have

• Experience across several of the domains above rather than one.
• Experience at sites you did not fully control: cloud, colocation or GPU cloud operators.
• Experience with federal assessment regimes based on NIST SP 800-53, including supply chain (NIST SP 800-161) and media sanitization (NIST SP 800-88) guidance, with evidence an assessor accepted.
• Built governance, risk and compliance (GRC) or evidence automation: automated control checks, asset or custody tracking, questionnaire and assessment pipelines, docs-as-code workflows.
• Run incident response at physical sites: alarms, investigations, after-action fixes.
• Worked in live data halls and on active construction sites, and can follow a method of procedure.
• Redlined contract security language with legal and procurement counterparts.
• Experience with international sites: per-country personnel screening and staffing restrictions, data residency, and export controls on hardware.
• Built AI agents or automation that replaced recurring manual security work.

Details

• Location: San Francisco, CA; remote-friendly with travel required.
• Regular travel to data center sites, which are critical infrastructure, and may include on-call for security events at them.
• Location-based hybrid policy: expected in an office at least 25% of the time.
• Employment type is not stated in the source.
• Visa sponsorship is available for some roles and candidates; not guaranteed for every role.