Senior Cybersecurity & Compliance Analyst

Zatlas is the payments automation platform for hospitality. We help large hotel chains in Latin America — and increasingly in Europe and the United States — turn every reservation from Booking.com, Expedia and other platforms into collected revenue, with far less manual work. We are backed by top VC investors in LATAM, the US and Europe, and we are hiring a Senior Cybersecurity & Compliance Analyst to own the security posture of our AWS environment and lead our SOC 2 and PCI-DSS programmes.

Why this role, and why now

Zatlas sits at the intersection of software and money movement. We collect on behalf of hotels, work with acquirers and card networks, and handle guest and payment data across several countries. For our clients, security is not a back-office concern; it is part of what they are buying, and SOC 2 and PCI-DSS are how we prove it.

This role is the primary subject-matter expert for both programmes in a cloud-native AWS ecosystem. You will take full ownership of AWS security controls, identity governance and threat monitoring, and you will design the security platforms they run on — hands-on, with the autonomy to architect rather than simply maintain.

What you will own

1. Compliance — SOC 2 and PCI-DSS

• Controls: lead the design, implementation and continuous monitoring of the security controls required for SOC 2 and PCI-DSS across our AWS infrastructure and application environment.

• Audits: spearhead internal audits, deep-dive AWS configuration reviews, risk assessments and gap analyses against the SOC 2 Trust Services Criteria and PCI-DSS requirements, so external audits land cleanly.

• Evidence: own and automate the collection and presentation of cloud security and compliance evidence, pulled directly from AWS and our security tools, for external auditors.

2. Identity and access

• Architect and govern AWS IAM and IAM Identity Center (SSO), strictly enforcing the principle of least privilege.

• Automate access reviews and manage complex user lifecycles across the environment.

3. Detection and response

• SIEM: engineer, optimise and oversee our SIEM platform alongside native AWS monitoring — CloudTrail, GuardDuty, Security Hub and CloudWatch — to detect, analyse and alert on advanced security incidents.

• XDR: drive our Extended Detection and Response strategy — proactive threat hunting, forensic investigations, and leading incident response across endpoints, networks and AWS workloads.

4. Policy and governance

• Develop, enforce and scale cloud security policies, incident response plans and governance procedures, aligned with industry standards and AWS Well-Architected best practices.

5. IT operations and security culture

• Oversee and automate baseline IT support and identity governance — onboarding, offboarding, access management — and act as the senior escalation point for complex IT and security tickets.

• Mentor junior team members and foster a security-first culture across engineering and product.

Who we are looking for

MUST HAVE

• 5+ years of progressive, hands-on experience in cybersecurity, cloud security or IT compliance. Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Technology or a related field.

• Advanced AWS security expertise. Securing AWS environments and managing native security tools at scale — IAM, GuardDuty, CloudTrail, KMS, Security Hub, WAF.

• A proven track record leading or deeply managing SOC 2 and PCI-DSS compliance initiatives, particularly in modern AWS cloud environments.

• Deep practical experience deploying and managing SIEM/XDR solutions and analysing complex telemetry — VPC Flow Logs, CloudTrail logs, system event logs.

• Strong cloud automation and Infrastructure as Code skills — Terraform, AWS CloudFormation or Python scripting — to automate security and compliance checks.

• A strategic, analytical approach to threat detection, mitigation and architecture, and the ability to run internal IT support and user access administration efficiently. Fluent English, written and spoken.

STRONG PLUS

• Spanish.

• AWS Certified Security – Specialty or AWS Certified Solutions Architect.

• CISSP, CISA or CISM.

• Experience securing payments or card-data environments.

• Mentoring junior security or IT team members.

PROBABLY NOT FOR YOU IF

• You want to focus on policy and audits only, without hands-on work in AWS and the tooling.

• You are looking for a large, fully staffed security team with settled processes. Much of this you will design and build.

• You see IT support and access requests as beneath the role. For now they are part of it — and automating them is the job.

How we work

We are a small, fast company operating in two languages and across several markets. Decisions get made quickly and in the open, with the reasoning attached — a clear answer we can revisit beats a perfect one that arrives too late. We expect the same from security: pragmatic, specific, automated wherever possible, and honest about risk. You will work with engineering and product on how the platform handles money and data, with the Founders on our risk posture and audit readiness, and with external auditors on SOC 2 and PCI-DSS.

What we offer

• Extensive career development and the autonomy to design and lead our cloud security and compliance architecture.

• Dedicated training resources, AWS certification sponsorship and professional development programmes.

• The opportunity to implement high-impact security controls using modern technologies.

• A collaborative, international team in a forward-thinking tech company.