GRC Analyst at Supabase at Supabase

About the Role

We are seeking a GRC Analyst to join our Compliance & Security team. Your mission will be to ensure risk management, audit, and compliance are integral to how Supabase operates. You will collaborate closely with engineering, security, IT, and legal teams to define our risk tolerance, maintain current compliance programs (including SOC 2 and ISO/IEC 27001:2022), test controls regularly, and provide accurate and prompt responses to customer and vendor security reviews. This position is ideal for someone who thrives in fast-paced, asynchronous environments and is excited by building scalable developer tools for millions of users.

What You Will Be Responsible For

• Conduct comprehensive risk assessments across the entire company and for major product changes. This includes scoring likelihood and impact, proposing treatment plans, and presenting findings to leadership to guide risk tolerance decisions.
• Maintain the risk register, diligently tracking remediation efforts until closure, and providing status updates to compliance and security leadership.
• Continuously monitor controls, leveraging automated tests where available and performing manual testing otherwise. You will triage any failures, prioritize them using the risk register, and assign clear owners and deadlines to each finding.
• Provide robust support during internal audits, whether conducted by external partners or in-house. This involves proposing the audit scope from the risk register, supplying necessary evidence, and tracking findings through to completion.
• Handle the day-to-day operations of our compliance programs, which includes evidence collection, following up with control owners, and ensuring readiness for each audit cycle.
• Extend continuous control validation beyond the scope of our existing compliance platform. This involves building custom tests using AI coding tools, partnering with engineering and IT to retrieve evidence directly from source systems instead of relying on screenshots, and verifying that each test accurately reflects the control requirements.

Qualifications - What You Might Be a Good Fit If You

• Possess 3 or more years of experience in GRC, internal audit, or security compliance within a SaaS or technology company.
• Are proficient and comfortable working with SOC 2 and ISO 27001 controls, and have experience with compliance platforms such as Drata, Vanta, and evidence extraction from systems like AWS, GCP, Google Workspace, and Okta.
• Demonstrate excellent communication skills, capable of interacting clearly with both highly technical and non-technical audiences.
• Have previous experience working in asynchronous or globally distributed team settings.
• Are motivated by solving practical, real-world problems for developers.
• Possess the ability to comfortably navigate ambiguity and maintain momentum while moving quickly.

What We Offer

• Fully Remote: We operate globally and believe you can do your best work from anywhere. There are no fixed Supabase offices, but we provide a WeWork membership or a co-working allowance usable anywhere in the world.
• ESOP: Every team member receives Employee Stock Ownership Plan equity in the company, ensuring everyone shares in the upside of our collective building efforts.
• Tech Allowance: A dedicated budget to help you set up your ideal remote workspace, covering items like laptops, monitors, headphones, or anything else that aids your productivity.
• Health Benefits: Supabase covers 100% of health insurance costs for employees and 80% for dependents, regardless of your location.
• Annual Off-Sites: Once annually, the entire company gathers in a new city for a week dedicated to connection, collaboration, and enjoyment.
• Flexible Work: Our culture is asynchronous, built on trust. You are empowered to manage your own time effectively based on deliverables.
• Professional Development: Each team member receives an annual education allowance to invest in learning, whether through courses, books, conferences, or other growth opportunities.

About the Team

Supabase was founded with a remote and open-source-first philosophy. We view our globally distributed team as a core strength in creating developer tools that developers genuinely love. We currently consist of about 400 team members spanning over 60 countries and speaking more than 20 languages. We have raised over $1B (including a $500M Series F) and boast a community of over 540,000 members. We move quickly, build openly, and utilize what we ship. We hold a deep commitment to the open-source ecosystem, striving to support existing tools and communities rather than replace them.