Senior Data Security Engineer

About the role

Design, implement and maintain the company's data protection controls across the full data lifecycle, covering business data, R&D and drug formulation data, manufacturing data (batch records) and personal data.

Key responsibilities

1. Data Governance and Data Classification

• Design and enforce a data classification scheme (e.g. Public / Internal / Confidential / Restricted) together with GRC and data owners.

• Perform data discovery and data inventory, including data flow mapping for critical data.

• Deploy automated scanning and labeling tools (e.g. Microsoft Purview, Varonis, BigID).

2. Data in Motion and Data in Use (DLP)

• Design, implement and tune DLP across endpoint, email, web, cloud apps and USB/removable devices.

• Manage policies so they work in practice: reduce false positives and avoid disrupting production and research teams.

• Prevent leakage of intellectual property (drug formulations, manufacturing processes) through DLP, IRM/rights management and watermarking.

• Coordinate with the Senior Cybersecurity Engineer and the MSSP to investigate DLP alerts.

3. Data at Rest and Encryption

• Define and maintain encryption standards (disk, database, file, backup, email, TLS), including key management (KMS/HSM, key rotation, key escrow).

• Protect file servers, SharePoint/OneDrive, databases, cloud storage and ERP/MES/LIMS/QMS systems together with system owners.

• Own database security (activity monitoring, access control, DBA privileged access).

4. Data Masking and Data Privacy

• Design and apply masking, tokenization, anonymization and pseudonymization for non-production environments (Dev, Test, UAT) and for data shared with third parties.

• Support the DPO / PDPA team in protecting personal data (employees, customers, patients/trial participants) as required.

5. Backup, Recovery and Data Resilience

• Design and govern the backup strategy (3-2-1-1-0 principle, immutable backup, air-gapped copy) aligned with the RPO/RTO of each system.

• Test restores regularly and keep evidence of the results (for use with auditors).

• Plan the data-side response to ransomware, together with the BCP/DR team.

• Define data retention and secure disposal policies aligned with GxP requirements and applicable law.

6. Data Integrity and GxP

• Support ALCOA+ principles on the IT side (audit trail, access control, protection against data alteration and deletion) together with QA and GRC.

• Assess the impact of data protection controls on GxP systems before deployment.

Qualifications

• Bachelor's degree or higher in Computer Science, IT, Cybersecurity or a related field.

• At least 6-8 years of experience in Data Security / Information Security, with hands-on experience in DLP or data classification.

• Understanding of encryption, PKI, key management and database security.

• Knowledge of backup and recovery (e.g. Veeam, Commvault, Rubrik, Cohesity) and storage / cloud storage.

• Understanding of personal data protection law (PDPA).

Preferred Certifications: CISSP, CISM, CCSP, Security+, Microsoft Purview/DLP certifications or certifications from the backup vendor in use, privacy certifications (CIPP/E, CIPM).

Additional Advantages: Experience with data in the pharmaceutical/biotech industry and an understanding of data integrity in a GxP environment.

Expected Skills and Behaviors

• Able to explain data risks to data owners and management, and build cooperation without obstructing work.

• Works well across departments (production, QA, R&D, marketing, HR, finance).

• Keeps documentation and evidence in good order, as it must withstand regulatory inspection.