Security & Data Developer (Supabase, APIs, Secrets, Remote, Long-Term)

We're a US creative-growth company running several web apps and data pipelines. We're hiring a security and data developer to harden our stack and keep our data clean and safe. What you'll own: - Secrets lifecycle: issuing, rotating, and revoking API tokens, OAuth secrets, and access keys across our services - Supabase security: row-level-security (RLS) policy audits, auth review, safe storage rules - API hardening: our internal gateway that brokers third-party API access (token issuance, revocation, rate limiting) - Automated security scanning (SAST, secret-scanning, dependency/CVE scanning) and fixing what it finds - Data pipeline integrity: making sure sync and enrollment jobs run clean, with no data loss or PII leaking into logs - Encryption at rest and in transit, and clean onboarding/offboarding of team access You're a fit if you: - Are genuinely fluent in written and spoken English - Have real production experience with Supabase (or Postgres RLS), Vercel, and Node/JavaScript - Understand OAuth, API key management, and secrets rotation properly - Have worked with security scanning tools (Semgrep, gitleaks, osv-scanner, or similar) - Care about data privacy and least-privilege access - Can explain risk in plain English to a non-technical owner Setup: fully remote. You'll work against our hosted infrastructure through access we provision. We use a credential-free model wherever possible. Please answer the screening questions when you apply. Applicants who don't answer them won't be considered.