Skip to content

GRC

GRC Analyst

Supabase logoSupabaseRemote, any countryFull-timePosted 3w ago
Apply on Supabase (shows the role here)Supabase as an employer: salaries and roles

The full posting

About the Role

We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately.

This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.

What You’ll Be Responsible For

  • Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions.
  • Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
  • Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date.
  • Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure.
  • Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period.
  • Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires.

You Might Be a Good Fit If You

  • Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
  • Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta
  • Communicate clearly across both technical and non-technical audiences
  • Have experience in async or globally distributed teams
  • Are energized by solving real-world problems for developers
  • Are comfortable navigating ambiguity and moving quickly

What We Offer

  • Fully Remote We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world.
  • ESOP Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together.
  • Tech Allowance Use this budget to set up your ideal work environment - laptop, monitor, headphones, or whatever helps you do your best work.
  • Health Benefits Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us.
  • Annual Off-Sites Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year.
  • Flexible Work We operate asynchronously and trust you to manage your own time. You know what needs to be done and when.
  • Professional Development Every team member receives an annual education allowance to spend on learning - courses, books, conferences, or anything that supports your growth.

About the Team

Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love.

  • ~400 team members
  • 60+ countries
  • 20+ languages spoken
  • Over $1B raised (including our $500M Series F)
  • 540,000+ community members

We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support - not replace - existing tools and communities.

Where you can be based

This position is 100% remote and open to applicants anywhere in the world.

Text as Supabase published it; last compared with the original on 12 Nov 2026.

Apply on Supabase (shows the role here)

The application

Your details, CV, GitHub and LinkedIn, then 5 questions (2 written).

Keep these to handCVGitHubLinkedInX profile (optional)
  1. 1.
    Passport CountryShort answer
  2. 2.
    Country of ResidenceShort answer
  3. 3.
    Are you over the age of 18?Yes or no
  4. 4.
    Tell us about your experience working in an async and/or remote environment. What practices or approaches have worked well for you? What challenges have you faced?Written answer
  5. 5.
    Have you made any open source contributions in the past that you'd like to share with us?Written answer · optional

Taken from Supabase's application form as it stood on 12 Nov 2026.

The employer: Supabase

Provides a hosted Postgres backend with auth, storage and APIs for app developers; it wants a GRC analyst who can work from anywhere.

Pay and benefits: Full-time compliance role, remote from any country.

Full postings from Supabase All Supabase openings on the board Supabase employer profile

Other security roles worth a look

Led audits or a certification programme?

Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.

Create my profile

Hear first when Supabase posts a security role

We read Supabase's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.

GRC Analyst at Supabase | CyberJobs.cc