安全与合规分析师
Security and Compliance Analyst
Peek 是支撑体验行业运营的操作系统——从博物馆和景点到旅游和活动。凭借超过 70 亿美元的预订量，Peek 的人工智能驱动平台已帮助数千家商户提高收入、节省时间并提供无缝的客户体验。客户包括 MoMA、惠特尼博物馆、西雅图水族馆、布赖恩特公园和 Looping Group。公司已从 Westcap、高盛和 SpringCoast Partners 等机构投资者处筹集了超过 1.5 亿美元。了解更多请访问 。
作为一家以远程办公为先的公司，Peek 被 Forbes 评为美国最佳初创雇主之一，并被 Built In 评为 2025 和 2026 年最佳工作场所。我们是一支全球化的“Peeksters”团队，他们“专注于客户”，“成就大事”，“有目的协作”，并且“每天进步”。
职位描述
我们正在招聘一名安全与合规分析师，负责在 Peek 全球范围内运行并加强我们的安全、合规和治理计划。
你将负责日常合规计划的运作，包括 SOC 2、PCI DSS、NF525 和可访问性，以及各种数据保护法规（GDPR、CCPA、CPRA 等）。你将是审计师的主要联系人，并且是销售团队在客户安全审查方面的可靠合作伙伴。你将与我们的 DevSecOps 工程师紧密合作：他们负责技术控制和修复，而你则负责展示这些控制措施有效的计划。
你应该有运行审计周期的经验，并能够独立推动跨团队的工作。我们不要求你在每个领域都有深入的专业知识。例如，NF525 和可访问性可以在工作中学习。
你将与工程、DevOps、IT、产品、销售、法律和外部审计师密切合作，以理解需求、收集证据、识别差距、协调修复，并帮助在大规模操作中让安全和合规更易管理。
你将负责
- 负责日常合规计划的运作，包括 SOC 2、PCI DSS、NF525、GDPR 和可访问性。
- 作为审计师的主要联系人，全程主导审计和认证流程：范围界定、时间表、证据、请求、发现和修复跟进。
- 负责我们的合规平台（Drata），保持控制映射、证据和政策的最新状态。
- 维护和改进安全策略、程序、控制措施和风险登记册。识别控制差距，推荐修复方案，并与工程、DevOps、IT、产品、人力资源和其他团队的控制负责人推动修复至完成。
- 定期开展治理活动
查看英文原文
Peek is the operating system powering the experiences industry - from museums and attractions to tours and activities. With over $7B in bookings, Peek’s AI-powered platform has helped thousands of merchants to increase revenues, save time, and deliver seamless guest experiences. Customers include MoMA, Whitney Museum, Seattle Aquarium, Bryant Park & Looping Group. The company has raised over $150 million from institutional investors Westcap, Goldman Sachs, and SpringCoast Partners. Learn more at www.peek.com http://www.peek.com.
As a remote-first company recognized by Forbes as one of America's Best Startup Employers and by Built In as a 2025 and 2026 Best Place to Work, we are a global team of "Peeksters" who "Obsess Over Our Customers," "Accomplish Big Things," "Collaborate With Purpose," and "Get Better Every Day.
THE ROLE
We're hiring a Security & Compliance Analyst to run and strengthen our security, compliance, and governance programs across Peek.
You'll own day-to-day operation of our compliance programs, including SOC 2, PCI DSS, NF525, and accessibility, and various data protection regulations (GDPR, CCPA, CPRA…). You'll be the primary point of contact for auditors and a trusted partner to Sales on customer security reviews. You'll work closely with our DevSecOps Engineer: they own technical controls and remediation, and you run the program that shows those controls work.
You should have run audit cycles before and be comfortable driving work across teams independently. We don't expect deep expertise in every area. NF525 and accessibility, for example, can be learned on the job.
You’ll work closely with Engineering, DevOps, IT, Product, Sales, Legal, and external auditors to understand requirements, collect evidence, identify gaps, coordinate remediation, and help make security and compliance easier to operate at scale.
WHAT YOU’LL DO
- Own day-to-day operation of our compliance programs, including SOC 2, PCI DSS, NF525, GDPR, and accessibility.
- Lead audit and certification cycles end to end as the primary point of contact for auditors: scoping, timelines, evidence, requests, findings, and remediation follow-up.
- Own our compliance platform (Drata), keeping control mappings, evidence, and policies current.
- Maintain and improve security policies, procedures, controls, and the risk register. Identify control gaps, recommend fixes, and drive remediation to closure with control owners in Engineering, DevOps, IT, Product, HR, and other teams.
- Run periodic governance activities: access reviews, policy reviews, risk assessments, business continuity plan reviews and test documentation, and vendor security and privacy assessments, bringing in technical experts for higher-risk vendors.
- Run our data protection program day to day: records of processing, data processing agreements, impact assessments for new features, data subject requests, and data classification and retention standards. Partner with Legal on breach assessment and notification.
- Lead responses to customer security and privacy questionnaires and RFPs with Sales, and maintain a reusable answer library.
- Coordinate accessibility compliance with Product, Design, and Engineering, tracking assessments, findings, and the remediation those teams own.
- Report on program status, risks, and audit readiness to leadership.
- Use AI and automation to reduce repetitive work such as evidence collection, control mapping, questionnaires, and reporting, including building AI-assisted workflows that help teams find accurate security answers.
WHAT WE’RE LOOKING FOR
Required
- 3–5 years in security compliance, GRC, IT audit, risk, or a related field
- Hands-on experience running or supporting at least one SOC 2 Type II or PCI DSS audit cycle end to end
- Working knowledge of SOC 2 trust services criteria and/or PCI DSS requirements
- Experience with a GRC or compliance automation platform (Drata or similar)
- Experience conducting vendor or third-party security risk assessments
- Experience responding to customer security questionnaires or RFPs
- A solid understanding of access controls, authentication, vulnerability management, encryption, logging, incident response, change management, and cloud infrastructure, enough to evaluate evidence and challenge control owners when needed
- Strong organization and follow-through, with the ability to manage multiple work streams independently
- Clear written and verbal communication with engineers, business teams, auditors, and leadership
NICE TO HAVES
- Experience with Drata
- Accessibility standards such as WCAG
- Familiarity with NF525
- Working with SaaS products, cloud infrastructure, or engineering teams
- Using AI tools or building AI agents and automations for security, compliance, or governance work
- Familiarity with AI governance, particularly the EU AI Act and standards such as ISO/IEC 42001, and a view on how they apply to a company like Peek.
- Certifications such as CISA, CRISC, CIPP/E, or Security+
WHAT WE VALUE
A few things that will make you successful in this role:
- Ownership. You keep track of the details, follow through, and make sure things don’t quietly fall through the cracks.
- Curiosity. Security and compliance cover a lot of ground. We value people who are comfortable saying “I don’t know yet” and then figuring it out.
- Pragmatism. Compliance shouldn’t exist just to check a box. We want controls and processes that reduce real risk and work for the teams operating them.
- Clear communication. You can translate requirements into understandable actions and communicate effectively with engineers, auditors, customers, and business teams.
- Continuous improvement. If a process is repetitive, confusing, or overly manual, you’ll look for ways to make it better.
Peek Travel Inc. is an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, veteran status, disability, or other legally protected status.
If you are unable to apply due to incompatible assistive technology or a disability, please contact us at talent@peek.com. We will make every effort to respond to your request for disability assistance as soon as possible.