GRC Analyst

Location: Remote, global; fully remote with no offices and the ability to work from anywhere in the world.

Company

Supabase is an open-source-first developer tools company with a globally distributed team building tools used by developers.

What you will do

• Run risk assessments for the company and major product changes, score likelihood and impact, propose treatments, and present results to leadership.
• Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
• Monitor controls on a rolling basis using automated and manual testing, triage failures, and assign findings to owners with due dates.
• Support internal audits by proposing scope, supplying evidence, and tracking findings to closure.
• Run day-to-day operations for SOC 2 and ISO/IEC 27001:2022 compliance programs, including evidence collection, control-owner follow-up, and audit readiness.
• Build custom continuous-control tests with AI coding tools and work with engineering and IT to retrieve evidence from source systems instead of screenshots.

Requirements

• 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company.
• Practical familiarity with SOC 2 and ISO 27001 controls.
• Experience with a compliance platform such as Drata or Vanta.
• Experience working with evidence from AWS, GCP, Google Workspace, and Okta.
• Clear communication with both technical and non-technical audiences.
• Experience working in async or globally distributed teams.
• Ability to navigate ambiguity and move quickly.
• Interest in solving real-world problems for developers.

Culture & Benefits

• Fully remote, async work with a globally distributed team across 60+ countries.
• WeWork membership or co-working allowance usable anywhere in the world.
• ESOP equity ownership for every team member.
• Tech allowance, health insurance covering 100% for employees and 80% for dependents, and an annual education allowance.
• Annual company off-sites in a new city.
• Open-source-first culture with public development and flexible work.