Remote GRC Analyst: SOC 2 & ISO 27001

Supabase; Spain; Remote; EUR 50,000 - 70,000; Full time

Benefits offered by this job

Fully Remote

ESOP

Tech allowance

Health insurance

Annual off-sites

Flexible work

Education allowance

Job summary

Supabase is seeking a GRC Analyst to join our Compliance & Security team and help make risk management, audit, and compliance a continuous part of how Supabase runs. You’ll work with engineering, security, IT, and legal to keep SOC 2 and ISO/IEC 27001:2022 current, test controls, and respond to customer and vendor security reviews quickly.

This role thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.

Qualifications

• 3+ years in GRC, internal audit, or security compliance at a SaaS/tech company.
• Familiar with SOC 2 and ISO 27001 controls and evidence from cloud platforms.
• Experience with Drata or Vanta for evidence collection.
• Strong written and verbal communication across technical and non-technical audiences.
• Comfortable in async or globally distributed teams.
• Energized by solving real-world developer security problems.

Responsibilities

• Run risk assessments across the company and major product changes.
• Maintain the risk register, track remediation to closure, and report status to leadership.
• Monitor controls with automated tests where possible and manual testing where not.
• Support internal audit: propose scope, supply evidence, and track findings to closure.
• Run day-to-day operations for compliance programs: evidence collection and owner follow-up.
• Extend continuous control validation with AI tooling and source-system evidence.

Skills

GRC experience

Internal audit

Security compliance

Clear communication

Async/global teams

Developers security mindset

Tools

Drata

Vanta

AWS

GCP

Google Workspace

Okta

Job description

Supabase is seeking a GRC Analyst to join our Compliance & Security team and help make risk management, audit, and compliance a continuous part of how Supabase runs. You’ll work with engineering, security, IT, and legal to keep SOC 2 and ISO/IEC 27001:2022 current, test controls, and respond to customer and vendor security reviews quickly.

This role thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.