Product Manager - Security & Trust (EMEA/AMER)

Supabase is the Postgres development platform, built by developers for developers to help them ship countless products that people love. More than 7 million developers trust us with their data, and we are custodians of every byte of it. Security is foundational to that trust, and as we move deeper into AI-native development, regulated industries, and enterprise, it shapes whether a developer chooses us on day one and whether a regulated company can build their most sensitive workloads on Supabase.

About the Role

We're looking for a PM who can balance the constant tension between security and developer experience at platform scale. Every control you add is friction a developer has to absorb, and every default you loosen is a door an attacker could walk through. Finding the right balance between protecting customers and keeping them fast is the work of this role.

You'll partner with Security Engineering, Compliance, and the platform teams that own auth, networking, and audit.

This is a remote position open to candidates located across EMEA and AMER time zones.

In This Role You Will

• Set the security agenda for the platform: Lead Supabase's platform security roadmap end-to-end, from the defaults that protect a developer prototyping their first project to the advanced controls a Fortune 500 CISO needs before approving us.
• Hold the line between security and developer experience: Balance protection against friction so controls safeguard users without pushing developers off the platform.
• Lead our security strategy for AI agents: Lead how Supabase authenticates, scopes, and audits agent activity so customers can give them real capability while staying in control of their data.
• Own our security product surface: Drive the roadmap for firewall, security advisors, audit logs, Supabase Vault, just-in-time database access, and IAM primitives.
• Define the unified access model across Supabase: Set the strategy for roles, permissions, personal access tokens, OAuth integrations, organization and project modeling, SSO, and SCIM, driving cross-cutting RFCs from proposal to shipped code.
• Drive the compliance roadmap: Define what comes next beyond SOC2 and HIPAA so more regulated companies can adopt Supabase.
• Be the customer's voice for security: Speak with enterprise prospects, regulated customers, and security teams, translating feedback into a trusted roadmap.
• Ship the docs that go with the code: Create clear, opinionated, and trustworthy security guides for developers evaluating Supabase.

You Might Be a Good Fit If You

• Have 7+ years in product management, with significant time on security, identity and access, infrastructure, or developer platform products.
• Have deep working knowledge of security primitives: authentication, authorization (RBAC, RLS), audit logging, secrets management, and OAuth.
• Have a track record of leading cross-functional initiatives across Product, Engineering, Security, GTM, and Compliance, driving multi-team RFCs from proposal to shipped code.
• Are 100% comfortable in a remote, async, write-it-down culture.
• Are an exceptional writer capable of drafting customer-facing disclosures, internal threat models, documentation, or CISO one-pagers.

Nice to Have

• Compliance fluency with programs like SOC2, HIPAA, ISO 27001, PCI, or FedRAMP.
• Technical depth in Postgres, auth systems, or networking primitives.
• Experience designing access models for AI agents or automated systems.
• Shipped security features approved by enterprise CISOs.

What We Offer

• Fully Remote: Work from anywhere with a WeWork membership or co-working allowance provided.
• ESOP: Equity ownership for every team member.
• Tech Allowance: Budget to set up your ideal work environment.
• Health Benefits: 100% health insurance coverage for employees and 80% for dependents.
• Annual Off-Sites: Company-wide annual retreat.
• Flexible Work: Asynchronous operations and self-managed schedules.
• Professional Development: Annual education allowance for courses, books, and conferences.