Security and Compliance Analyst

About the role

Peek powers the experiences industry with an AI‑driven platform used by museums, attractions and tours worldwide. As a remote‑first company recognized for its workplace culture, Peek is looking for a Security & Compliance Analyst to own and strengthen its security, compliance and governance programs.

Key responsibilities

• Own day‑to‑day operation of compliance programs including SOC 2, PCI DSS, NF525, GDPR and accessibility.
• Lead audit and certification cycles end to end as the primary point of contact for auditors.
• Maintain the compliance platform (Drata), keeping control mappings, evidence and policies up to date.
• Develop and improve security policies, procedures, controls and the risk register, driving remediation with engineering and other teams.
• Run periodic governance activities such as access reviews, policy reviews, risk assessments, business continuity testing and vendor security assessments.
• Manage the data‑protection program: processing records, data‑processing agreements, impact assessments, data‑subject requests and classification standards.
• Lead responses to customer security and privacy questionnaires and RFPs, maintaining a reusable answer library.
• Coordinate accessibility compliance with product, design and engineering, tracking findings and remediation.
• Report program status, risks and audit readiness to leadership and use AI‑driven automation to streamline evidence collection and reporting.

Required profile

• 3–5 years of experience in security compliance, GRC, IT audit, risk or a related field.
• Hands‑on experience running or supporting at least one SOC 2 Type II or PCI DSS audit cycle end to end.
• Working knowledge of SOC 2 trust services criteria and/or PCI DSS requirements.
• Experience with a GRC or compliance automation platform such as Drata.
• Experience conducting vendor or third‑party security risk assessments and responding to customer security questionnaires.
• Solid understanding of access controls, authentication, vulnerability management, encryption, logging, incident response, change management and cloud infrastructure.
• Strong organization, ability to manage multiple work streams independently and clear written and verbal communication.

Required skills

• SOC 2
• PCI DSS
• NF525
• GDPR
• CCPA
• CPRA
• Drata
• GRC platform
• Cloud infrastructure
• Access controls
• Authentication
• Vulnerability management
• Encryption
• Logging
• Incident response
• Change management
• WCAG (accessibility)