GRC Analyst

About This Role

Working as a GRC Analyst, you will join the Compliance & Security team to integrate risk management, audit, and compliance into Supabase's operations. You will collaborate with engineering, security, IT, and legal teams to define risk tolerance, maintain compliance programs like SOC 2 and ISO/IEC 27001:2022, conduct rolling control tests, and efficiently respond to customer and vendor security reviews.

Responsibilities

• Run risk assessments across the company and major product changes
• Score likelihood and impact, propose treatments, and present results to leadership for risk tolerance decisions
• Maintain the risk register, track remediation to closure, and report status to compliance and security leadership
• Monitor controls on a rolling basis, using automated and manual testing
• Triage failures, prioritize by the risk register, and align each finding with an owner and a due date
• Support internal audit, whether external or in-house: propose scope from the risk register, supply evidence, and track findings to closure
• Run day-to-day operations for compliance programs: evidence collection, control owner follow-up, and readiness for each audit period
• Extend continuous control validation beyond the compliance platform
• Build custom tests with AI coding tools
• Work with engineering and IT to pull evidence from source systems instead of collecting screenshots
• Check that each test proves what the control requires

Requirements

• 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
• Comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta
• Communicate clearly across both technical and non-technical audiences
• Experience in async or globally distributed teams
• Energized by solving real-world problems for developers
• Comfortable navigating ambiguity and moving quickly

Benefits

• WeWork membership or co-working allowance
• ESOP (equity ownership) in the company
• Tech allowance for work environment setup
• 100% health insurance coverage for employees and 80% for dependents
• Annual off-sites
• Flexible work arrangements
• Annual education allowance for professional development

About the Company

Supabase was born-remote and open-source-first, with a globally distributed team of approximately 400 members across 60+ countries, speaking 20+ languages. The company has raised over $1 billion, including a $500 million Series F, and has over 540,000 community members. They move fast, build in public, and use what they ship, deeply believing in and supporting the open-source ecosystem.