GRC Analyst
关于角色 我们正在寻找一个 GRC 分析师，加入我们的合规与安全团队并帮助使风险管理，审计和合规成为 Supabase 运行的持续组成部分。你将密切合作工程，安全，IT 和法律来帮助我们定义我们的风险耐受性，保持我们的合规计划 （包括 SOC 2 和 ISO/IEC 27001:2022）,不断测试控制，快速准确地回答客户和供应商的安全评价。这个职位是适合在非同步，快节环境中壮成长的人，并且热衷于建立数百万规模开发工具的人。- 执行公司范围内的风险评估和重大产品变化。评分概率和影响，提出治疗方案，并将结果向领导层提供以告知风险耐受性决策。- 维护风险登记册，追踪补救到关闭，并向合规与安全管理人员报告状态。- 随时监测控制，使用自动化测试在现有的情况下和手动测试在没有的情况下。处理失败，根据风险登录优先考虑，并与所有者和期限一致。- 支持内部审计，无论是由外部合作伙伴或内部进行的：建议从登记册中获得范围，提供证据，跟踪风险发现到关闭。- 运行我们合规程序的日常操作：收集证据，控制所有者跟踪和每次审计期前准备。- 扩大持续验证的监控范围超出我们的合规平台所涵盖的范围。使用人工智能编码工具建立定制测试，与工程和 IT 合作从源系统中获取证据而不是采集屏幕截图，并检查每个测试都证明了控制要求。你可能是适合你的 - 在 SaaS 或技术公司拥有3年以上 GRC,内部审核或安全遵守方面的经验 - 舒适使用 SOC 2和 ISO 27001控制，如 Drata,Vanta 等合规平台以及 AWS,GCP,Google Workspace 和 Okta 等系统的证据 - 在技术和非技术观众中明确沟通 - 有在异步或全球分布式团队中的经验 - 通过解决开发人员现实问题获得活力 - 舒服地导航模糊性并快速移动我们提供的东西 - 我们完全远程。我们认为你可以从任何地方做出最好的工作。没有 Supabase 办公室，但 w
查看英文原文
ABOUT THE ROLE
We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately.
This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.
WHAT YOU’LL BE RESPONSIBLE FOR
- Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions.
- Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
- Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date.
- Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure.
- Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period.
- Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires.
YOU MIGHT BE A GOOD FIT IF YOU
- Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
- Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta
- Communicate clearly across both technical and non-technical audiences
- Have experience in async or globally distributed teams
- Are energized by solving real-world problems for developers
- Are comfortable navigating ambiguity and moving quickly
WHAT WE OFFER
- Fully Remote
We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world.
- ESOP
Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together.
- Tech Allowance
Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work.
- Health Benefits
Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us.
- Annual Off-Sites
Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year.
- Flexible Work
We operate asynchronously and trust you to manage your own time. You know what needs to be done and when.
- Professional Development
Every team member receives an annual education allowance to spend on learning—courses, books, conferences, or anything that supports your growth.
ABOUT THE TEAM
Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love.
- ~400 team members
- 60+ countries
- 20+ languages spoken
- Over $1B raised (including our $500M Series F)
- 540,000+ community members
We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support—not replace—existing tools and communities.