[Hiring] Security and Compliance Analyst @Peek

Role Description

We're hiring a Security & Compliance Analyst to run and strengthen our security, compliance, and governance programs across Peek.

• Own day-to-day operation of our compliance programs, including SOC 2, PCI DSS, NF525, GDPR, and accessibility.
• Lead audit and certification cycles end to end as the primary point of contact for auditors: scoping, timelines, evidence, requests, findings, and remediation follow-up.
• Own our compliance platform (Drata), keeping control mappings, evidence, and policies current.
• Maintain and improve security policies, procedures, controls, and the risk register.
• Identify control gaps, recommend fixes, and drive remediation to closure with control owners in Engineering, DevOps, IT, Product, HR, and other teams.
• Run periodic governance activities: access reviews, policy reviews, risk assessments, business continuity plan reviews and test documentation, and vendor security and privacy assessments.
• Run our data protection program day to day: records of processing, data processing agreements, impact assessments for new features, data subject requests, and data classification and retention standards.
• Partner with Legal on breach assessment and notification.
• Lead responses to customer security and privacy questionnaires and RFPs with Sales, and maintain a reusable answer library.
• Coordinate accessibility compliance with Product, Design, and Engineering, tracking assessments, findings, and the remediation those teams own.
• Report on program status, risks, and audit readiness to leadership.
• Use AI and automation to reduce repetitive work such as evidence collection, control mapping, questionnaires, and reporting.

Qualifications

• 3–5 years in security compliance, GRC, IT audit, risk, or a related field.
• Hands-on experience running or supporting at least one SOC 2 Type II or PCI DSS audit cycle end to end.
• Working knowledge of SOC 2 trust services criteria and/or PCI DSS requirements.
• Experience with a GRC or compliance automation platform (Drata or similar).
• Experience conducting vendor or third-party security risk assessments.
• Experience responding to customer security questionnaires or RFPs.
• A solid understanding of access controls, authentication, vulnerability management, encryption, logging, incident response, change management, and cloud infrastructure.
• Strong organization and follow-through, with the ability to manage multiple work streams independently.
• Clear written and verbal communication with engineers, business teams, auditors, and leadership.

Requirements

• Experience with Drata.
• Accessibility standards such as WCAG.
• Familiarity with NF525.
• Working with SaaS products, cloud infrastructure, or engineering teams.
• Using AI tools or building AI agents and automations for security, compliance, or governance work.
• Familiarity with AI governance, particularly the EU AI Act and standards such as ISO/IEC 42001.
• Certifications such as CISA, CRISC, CIPP/E, or Security+.

Benefits

• Ownership: You keep track of the details, follow through, and make sure things don’t quietly fall through the cracks.
• Curiosity: We value people who are comfortable saying “I don’t know yet” and then figuring it out.
• Pragmatism: We want controls and processes that reduce real risk and work for the teams operating them.
• Clear communication: You can translate requirements into understandable actions.
• Continuous improvement: If a process is repetitive, confusing, or overly manual, you’ll look for ways to make it better.