From the listing

About the role

We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance and keep compliance programs current.

Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love. We move fast, build in public, and use what we ship.

This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.

What you'll do

Run risk assessments across the company and major product changes, scoring likelihood and impact to inform leadership decisions.
Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
Monitor controls on a rolling basis using automated and manual testing, triaging failures and aligning findings with owners.
Support internal audit by proposing scope from the risk register, supplying evidence, and tracking findings to closure.
Run day-to-day operations for compliance programs including evidence collection and readiness ahead of audit periods.
Extend continuous control validation by building custom tests with AI coding tools and pulling evidence directly from source systems.

What they're looking for

3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company.
Comfortable working with SOC 2 and ISO 27001 controls and compliance platforms such as Drata or Vanta.
Experience with systems like AWS, GCP, Google Workspace, and Okta.
Ability to communicate clearly across both technical and non-technical audiences.
Comfortable navigating ambiguity and moving quickly.

Nice to have

Experience in async or globally distributed teams.
Energized by solving real-world problems for developers.

From the company page

Supabase benefits

Work from anywhereFlexible working hoursComprehensive benefitsAsynchronous workPaid retreatsWorkspace stipendPaid learning stipends

◉ Remote policy · in their words

“"Fully Remote. We hire globally. Work remotely from anywhere in the world. We work in teams, but we work asynchronously."”

Pulled from their careers page · verified by Atlas

The hot takeJeff's read on Supabase

Jeff hasn't written this one up yet.

Ask, and Supabase jumps the queue.