GRC Analyst

The role

You will help make risk management, audit, and compliance a continuous part of how Supabase runs. You will work with engineering, security, IT, and legal to define risk tolerance, maintain compliance programs, and test controls.

What you will do

• Run risk assessments across the company and major product changes.
• Maintain the risk register and track remediation to closure.
• Monitor controls on a rolling basis using automated and manual testing.
• Triage failures and align findings with an owner and a due date.
• Support internal audit by proposing scope and supplying evidence.
• Run day-to-day operations for compliance programs including evidence collection.
• Extend continuous control validation by building custom tests with AI coding tools.
• Work with engineering and IT to pull evidence from source systems.

Required qualifications

• 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
• Comfortable working with SOC 2 and ISO 27001 controls
• Experience with a compliance platform such as Drata or Vanta
• Experience with evidence from systems like AWS, GCP, Google Workspace, and Okta
• Communicate clearly across both technical and non-technical audiences
• Experience in async or globally distributed teams
• Comfortable navigating ambiguity and moving quickly

Nice to have

• Energized by solving real-world problems for developers

Benefits

• WeWork membership or co-working allowance
• ESOP (equity ownership)
• Tech Allowance for work environment setup
• 100% health insurance for employees
• 80% health insurance for dependents
• Annual Off-Sites
• Flexible Work
• Annual education allowance

About the company

Supabase is a born-remote and open-source-first company with approximately 400 team members in over 60 countries. They have raised over $1B and have a community of over 540,000 members.