Data Platform Security Engineer
Summary
Security engineer who builds and runs secure access for a cloud data platform on Azure (Snowflake, PostgreSQL, streaming, BI): RBAC-as-code with Terraform, data masking and encryption, secure remote access, Splunk/Grafana detections, CI/CD security gates, and incident response with on-call for a European client.
Salary: RM 4,600 – RM 6,900 per month
Key Responsibilities
Access management as code – Build/maintain RBAC across Azure, Snowflake, PostgreSQL, streaming and BI tools using Terraform, with tiered access (full, masked, metadata-only) and just-in-time access.
Data protection controls – Masking and row-access policies, masked non-production data, encryption, Key Vault, and API security.
Secure remote access – Locked-down virtual desktops, Private Link, and network segmentation.
Security monitoring – Write detections in Splunk/Grafana and ensure audit logs are complete.
CI/CD security – Add security gates to pipelines and review new integrations before production.
Incident response – Handle security incidents (including on-call during peak periods) and produce technical evidence for audits.
Requirements
Bachelor's degree in Computer Science, Engineering, or equivalent.
3+ years in cloud or data platform engineering, including hands-on security work.
Working understanding of GDPR principles (data minimisation, pseudonymisation, personal data handling).
Fluent English; able to work Central European business hours and travel internationally at short notice.
Security experience for Kafka, Event Hub, Service Bus, Flink, NiFi, Airflow, or Azure Functions.
High availability/disaster recovery on Azure; managed service experience with a European client.
Tech Stack
Azure security: Entra ID (Conditional Access, PIM, managed identities), RBAC, VNets/NSGs, Private Link, Key Vault, Defender for Cloud, Azure Policy
Data platform security: Snowflake (roles, dynamic masking, row-access policies, audit history), PostgreSQL (roles, row-level security)
IaC & CI/CD: Terraform, Azure DevOps or GitHub Actions, secret and IaC scanning
Scripting: Python (Azure/Snowflake SDKs), SQL
Monitoring & incidents: Splunk, Grafana, Azure Monitor (KQL), ITIL processes in ServiceNow
Data governance: Microsoft Purview or equivalent (cataloguing, classification, sensitivity labels, DLP, lineage)