Remote GRC Analyst: Risk & Compliance for Scalable SaaS

Supabase; Austria; Remote; EUR 65,000 - 90,000; Full time

Benefits offered by this job

Remote work globally

ESOP

Tech allowance

Health insurance

Annual off-sites

Flexible work

Education allowance

Job summary

Supabase is seeking a GRC Analyst to join our Compliance & Security team to make risk management and audit a continuous part of how we operate. You’ll work with engineering, security, IT, and legal to define risk tolerance, keep SOC 2 and ISO/IEC 27001:2022 current, and test controls on a rolling basis.

This role thrives in async, fast-paced environments and supports developers with scalable tooling. Fully remote, globally distributed team, with a strong focus on security reviews and

Qualifications

• 3+ years in GRC, internal audit, or security compliance at a SaaS/tech company.
• Experience with SOC 2 and ISO 27001 controls and related tooling.
• Ability to communicate clearly across technical and non-technical audiences.

Responsibilities

• Run risk assessments across the company and product changes, score likelihood and impact, and inform leadership.
• Maintain risk register, track remediation, and report status to leadership.
• Monitor controls with automated tests and manual testing where needed; triage failures and assign owners.
• Support internal audits by proposing scope, supplying evidence, and tracking findings to closure.
• Run day-to-day operations for compliance programs: evidence collection and readiness before audits.
• Extend control validation with AI tools and pull evidence from source systems.

Skills

GRC experience

SOC 2 controls

ISO 27001 controls

risk assessment

clear communication

distributed teams

Job description

Supabase is seeking a GRC Analyst to join our Compliance & Security team to make risk management and audit a continuous part of how we operate. You’ll work with engineering, security, IT, and legal to define risk tolerance, keep SOC 2 and ISO/IEC 27001:2022 current, and test controls on a rolling basis.

This role thrives in async, fast-paced environments and supports developers with scalable tooling. Fully remote, globally distributed team, with a strong focus on security reviews and