SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Supabase is seeking a GRC Analyst to join the Compliance & Security team and embed risk management, audit, and compliance into the company's operations. You will partner with engineering, security, IT, and legal teams to define risk tolerance, maintain compliance programs (SOC 2 and ISO/IEC 27001:2022), test controls continuously, and respond to customer and vendor security reviews.
Key Responsibilities:
- Conduct risk assessments across the company and major product changes; score likelihood and impact, propose treatments, and present findings to leadership to inform risk tolerance decisions.
- Maintain and update the risk register, track remediation efforts to closure, and report status to compliance and security leadership.
- Monitor controls on a rolling basis using automated tests where available and manual testing where needed; triage failures, prioritize by risk register, and assign findings to owners with due dates.
- Support internal and external audits by proposing scope from the risk register, supplying evidence, and tracking findings to closure.
- Manage day-to-day compliance program operations: evidence collection, control owner follow-up, and audit readiness.
- Extend continuous control validation beyond the compliance platform by building custom tests with AI coding tools, working with engineering and IT to pull evidence from source systems, and validating that each test proves control requirements.
About Supabase:
Supabase is a globally distributed, open-source-first company with ~400 team members across 60+ countries. The company has raised over $1B (including a $500M Series F) and serves 540,000+ community members. Supabase is fully remote with no physical offices, operating asynchronously across multiple time zones.
Requirements:
- 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company.
- Comfortable working with SOC 2 and ISO 27001 controls.
- Experience with compliance platforms such as Drata or Vanta.
- Familiarity with evidence from systems like AWS, GCP, Google Workspace, and Okta.
- Ability to communicate clearly across technical and non-technical audiences.
- Experience working in async or globally distributed teams.
- Comfortable navigating ambiguity and moving quickly.
