Remote GRC Analyst: SOC 2 & ISO 27001 Compliance

remote work; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Supabase is a fully remote, globally distributed company focused on developer tools and open source. This role owns risk management, audit support, and compliance programs including SOC 2 and ISO/IEC 27001:2022, working with engineering, security, IT, and legal.

You will run risk assessments, maintain the risk register, monitor controls with automated and manual tests, and triage findings with clear owners.

Qualifications

• 3+ years in GRC, internal audit, or security compliance at a SaaS or tech company.
• Experience with SOC 2 and ISO 27001 controls and evidence from systems like AWS, GCP, Google Workspace, Okta.
• Familiarity with compliance platforms such as Drata or Vanta.
• Strong communication across technical and non-technical audiences.
• Experience in async or globally distributed teams and navigating ambiguity.
• Interest in building developer tools that scale and working with AI coding tools.

Responsibilities

• Run risk assessments and inform leadership on risk tolerance decisions.
• Maintain the risk register and track remediation to closure.
• Monitor controls with automated tests and manual testing where needed.
• Triage failures, prioritize by risk, and assign owners and due dates.
• Support internal audits and provide evidence and scope from the risk register.
• Lead day-to-day operations for compliance programs and readiness ahead of audits.

Skills

GRC

risk management

internal audit

security compliance

communication

Job description

Supabase is a fully remote, globally distributed company focused on developer tools and open source. This role owns risk management, audit support, and compliance programs including SOC 2 and ISO/IEC 27001:2022, working with engineering, security, IT, and legal.

You will run risk assessments, maintain the risk register, monitor controls with automated and manual tests, and triage findings with clear owners.