GRC Analyst

remote work; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Supabase is a fully remote, globally distributed company focused on developer tools and open source. This role owns risk management, audit support, and compliance programs including SOC 2 and ISO/IEC 27001:2022, working with engineering, security, IT, and legal.

You will run risk assessments, maintain the risk register, monitor controls with automated and manual tests, and triage findings with clear owners.

Qualifications

• 3+ years in GRC, internal audit, or security compliance at a SaaS or tech company.
• Experience with SOC 2 and ISO 27001 controls and evidence from systems like AWS, GCP, Google Workspace, Okta.
• Familiarity with compliance platforms such as Drata or Vanta.
• Strong communication across technical and non-technical audiences.
• Experience in async or globally distributed teams and navigating ambiguity.
• Interest in building developer tools that scale and working with AI coding tools.

Responsibilities

• Run risk assessments and inform leadership on risk tolerance decisions.
• Maintain the risk register and track remediation to closure.
• Monitor controls with automated tests and manual testing where needed.
• Triage failures, prioritize by risk, and assign owners and due dates.
• Support internal audits and provide evidence and scope from the risk register.
• Lead day-to-day operations for compliance programs and readiness ahead of audits.

Skills

GRC

risk management

internal audit

security compliance

communication

Job description

About the role

Supabase is a fully remote, globally distributed company focused on developer tools and open source. This role owns risk management, audit support, and compliance programs including SOC 2 and ISO/IEC 27001:2022, working with engineering, security, IT, and legal.

What you'll do

• Run risk assessments and inform leadership on risk tolerance decisions
• Maintain the risk register and track remediation to closure
• Monitor controls with automated tests and manual testing where needed
• Triage failures, prioritize by risk, and assign owners and due dates
• Support internal audits and provide evidence and scope from the risk register
• Lead day-to-day operations for compliance programs and readiness ahead of audits

What they're looking for

• 3+ years in GRC, internal audit, or security compliance at a SaaS or tech company
• Experience with SOC 2 and ISO 27001 controls and evidence from systems like AWS, GCP, Google Workspace, Okta
• Familiarity with compliance platforms such as Drata or Vanta
• Strong communication across technical and non-technical audiences
• Experience in async or globally distributed teams and navigating ambiguity
• Interest in building developer tools that scale and working with AI coding tools

For applicants in Nigeria

• The listing states Fully Remote and hires globally, including globally distributed teams; Nigeria is eligible per the listing text
• The listing does not specify a timezone requirement; confirm before interviewing
• The listing does not state contractor vs employee status; confirm during interview process