Join Supabase as a GRC Analyst to enhance risk management and compliance in a fully remote, fast-paced environment.
Posted by employer 1 day ago
First seen on Joblaze 1 hour ago
Last verified on the company career page 1 hour ago
What you'll build
- Run risk assessments
- Maintain the risk register
- Monitor controls
- Support internal audit
- Run day-to-day operations for compliance programs
Must have
- 3+ years of experience in GRC, internal audit, or security compliance
- Comfortable working with SOC 2 and ISO 27001 controls
Nice to have
- Experience in async or globally distributed teams
- Energized by solving real-world problems for developers
AI in the day-to-day
Build custom tests with AI coding tools.
Requirements
- Experience
- 3+ years
Not disclosed in this posting: compensation, visa sponsorship.
Benefits
Joblaze summary
The GRC Analyst at Supabase plays a crucial role in integrating risk management and compliance into the company's operations, focusing on continuous assessment and improvement of controls. This position requires expertise in SOC 2 and ISO 27001, along with familiarity with compliance platforms and cloud services. Ideal candidates have over three years of experience in GRC or security compliance within a tech environment and are comfortable navigating fast-paced, asynchronous work settings. Supabase's fully remote and globally distributed team emphasizes collaboration and innovation in building developer tools.
Joblaze insights
- Listed today — first seen on Joblaze October 23, 2026. Last confirmed on Supabase's careers page October 23, 2026.
- AWS appears in 19.8% of 363 comparable mid security roles; Google Workspace appears in 3.3% of 363 comparable mid security roles.
Quick facts
- Is the GRC Analyst role remote?
- Yes — Supabase lists this as a fully remote position.
- How much experience is required?
- At least 3 years of relevant experience for this GRC Analyst role.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: AWS, GCP, Google Workspace, ISO 27001, Okta, SOC 2.
- What seniority level is this role?
- Supabase targets mid-level candidates for this position.
- Is this full-time or contract?
- Full-time for this GRC Analyst role at Supabase.
From the original posting
About the Role
We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately.
This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.
What You’ll Be Responsible For
Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions.
Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date.
Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure.
Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period.
Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires.
You Might Be a Good Fit If You
Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta
Communicate clearly across both technical and non-technical audiences
Have experience in async or globally distributed teams
Are energized by solving real-world problems for developers
Are comfortable navigating ambiguity and moving quickly
What We Offer
Fully Remote
ESOP
Tech Allowance
Health Benefits
Annual Off-Sites
Flexible Work
Professional Development
~400 team members
60+ countries
20+ languages spoken
540,000+ community members
Standard company text repeated across Supabase's postings is omitted here.