Supabase

More roles at Supabase

GRC Analyst

Work from anywhere

Employer explicitly allows international or location-independent remote work.

Worldwide

Employer listed it 6 days ago · Added 4 days ago

First listed 6 days ago and still open.

Salary

Not stated

Location

Worldwide

Work style

Async

Contract

Full-time

Experience

Mid

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.
Where you can work from: We believe you can do your best work from anywhere.
Contract: Not mentioned in the advert
Experience asked for: Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
Pay: Not mentioned in the advert

Remote flexibility

Work from anywhere

The employer explicitly allows candidates to work from anywhere in the world, with no stated country restriction.

What the employer says

Source listing states candidate location: "Remote, Global, Remote"
Job description states: "work from anywhere"

What Nomaders makes of it

Check timezone expectations before applying

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Questions worth asking: Nomaders interpretation

No pay is stated. Ask for the salary range before investing time in interviews.
The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

About the Role

We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately.

This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.

What You’ll Be Responsible For

Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions.

Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.

Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date.

Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure.

Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period.

Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires.

You Might Be a Good Fit If You

Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company

Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta

Communicate clearly across both technical and non-technical audiences

Have experience in async or globally distributed teams

Are energized by solving real-world problems for developers

Are comfortable navigating ambiguity and moving quickly

What We Offer

Fully Remote

We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world.

ESOP

Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together.

Tech Allowance

Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work.

Requirements

The employer hasn't listed requirements separately, they're described in the role summary above and on the original listing.

Benefits

·We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world.
·Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together.
·Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work.
·Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us.

How to apply

1Check the flexibility label above, work from anywhere, matches where you plan to live and work.
2Tailor your CV to the role at Supabase, mentioning your remote working experience and working hours (Async).
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 5d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.

Pay not stated · You'll be taken to the employer's careers page.