GRC Analyst

Supabase is a fully remote, globally distributed company focused on developer tools and open source. This role owns risk management, audit support, and compliance programs including SOC 2 and ISO/IEC 27001:2022, working with engineering, security, IT, and legal.

• Run risk assessments and inform leadership on risk tolerance decisions
• Maintain the risk register and track remediation to closure
• Monitor controls with automated tests and manual testing where needed
• Triage failures, prioritize by risk, and assign owners and due dates
• Support internal audits and provide evidence and scope from the risk register
• Lead day-to-day operations for compliance programs and readiness ahead of audits

• 3+ years in GRC, internal audit, or security compliance at a SaaS or tech company
• Experience with SOC 2 and ISO 27001 controls and evidence from systems like AWS, GCP, Google Workspace, Okta
• Familiarity with compliance platforms such as Drata or Vanta
• Strong communication across technical and non-technical audiences
• Experience in async or globally distributed teams and navigating ambiguity
• Interest in building developer tools that scale and working with AI coding tools

• The listing states Fully Remote and hires globally, including globally distributed teams;
  Nigeria is eligible per the listing text
• The listing does not specify a timezone requirement; confirm before interviewing
• The listing does not state contractor vs employee status; confirm during interview process