About the role

GRC Analyst managing risk assessments, audits, and continuous controls for Supabase’s open-source developer platform. Supporting SOC 2 and ISO 27001 compliance across a global remote team.

Responsibilities

Run risk assessments across the company and major product changes
Score likelihood and impact, propose treatments, and present results to leadership to inform risk tolerance decisions
Maintain the risk register, track remediation to closure, and report status to compliance and security leadership
Monitor controls on a rolling basis using automated and manual testing
Triage control failures, prioritize findings by the risk register, and assign owners and due dates
Support internal audits by proposing scope, supplying evidence, and tracking findings to closure
Run day-to-day compliance program operations, including evidence collection, control owner follow-up, and audit readiness
Extend continuous control validation beyond the compliance platform
Build custom tests with AI coding tools
Work with engineering and IT to pull evidence from source systems and validate that tests prove control requirements

3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
Comfortable working with SOC 2 and ISO 27001 controls
Experience with a compliance platform such as Drata or Vanta
Experience with evidence from systems such as AWS, GCP, Google Workspace, and Okta
Clear communication across technical and non-technical audiences
Experience in async or globally distributed teams
Comfortable navigating ambiguity and moving quickly

Fully remote
WeWork membership or co-working allowance usable anywhere in the world
ESOP (equity ownership) for every team member
Tech allowance for laptop, monitor, headphones, or other work equipment
Supabase covers 100% of health insurance for employees and 80% for dependents
Annual company off-sites
Flexible, asynchronous work
Annual education allowance for courses, books, conferences, or other professional development