All jobs
GRC Analyst
About this role
A GRC Analyst is sought to join Supabase's Compliance & Security team to integrate risk management, audit and compliance into the company’s operations. The role involves working with engineering, security, IT and legal to define risk tolerance, maintain and test compliance programs (including SOC 2 and ISO/IEC 27001:2022), and respond to customer and vendor security reviews. It is suited to someone who thrives in asynchronous, fast-paced work and is interested in building scalable developer tools. The job focuses on risk assessments, controls monitoring, and supporting internal and external audits. The team is globally distributed and the role is fully remote.
What you would do
- Run risk assessments across the company and major product changes, score likelihood and impact, propose treatments, and present results to leadership.
- Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
- Monitor controls on a rolling basis, using automated tests where available and manual testing where needed; triage failures and assign owners and due dates.
- Support internal audits by proposing scope, supplying evidence, and tracking findings to closure.
- Manage day-to-day operations for compliance programs, including evidence collection, control owner follow-up, and audit readiness.
- Extend continuous control validation beyond the compliance platform; build custom tests with AI coding tools and pull evidence from source systems.
What they are asking for
- 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company.
- Experience with SOC 2 and ISO 27001 controls and with compliance platforms such as Drata or Vanta.
- Experience gathering evidence from systems like AWS, GCP, Google Workspace and Okta.
- Clear communicator across technical and non-technical audiences.
- Experience in async or globally distributed teams.
Listing details are summarised from the source. Always confirm the role and the employer on the original posting before applying, and never pay to apply for a job.