Senior Data Security Solution Engineer

We are seeking a Senior Data Security Engineer to analyze the current business goal along with the Business Analysis team, create a solution and implement it.

Responsibilities

1. Technical and Database Assessment

• Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.

• Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.

• Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.

• Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.

2. Data-Level Authentication and Identity Integration

• Assess authentication for named users, service identities, workloads, and analytical tools accessing databases.

• Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.

• Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.

• Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.

• Align with tools currently available and identify gaps if any.

3. Fine-Grained Authorization and Data Firewalling

• Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.

• Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.

• Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.

• Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.

4. Auditing, Monitoring, and Traceability

• Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.

• Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.

• Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.

• Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.

5. Data Lifecycle, Revocation, and Deletion

• Design controls for access revocation when users change roles, leave a project, or when licensing rights expire.

• Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.

• Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.

• Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.

6. Solution Architecture and Engineering

• Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.

• Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.

• Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.

• Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.

7. POC Design and Execution

• Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.

• Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.

• Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.

• Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.

Expected Deliverables

• Technical assessment of databases, integrations, identities, and data flows

• Current-state database security and capability assessment

• Target-state data security architecture and detailed technical design

• Database authentication and identity-integration design

• Row-level, column-level, masking, and policy-enforcement design

• Data firewalling and licensed-dataset isolation pattern

• Audit, monitoring, traceability, and reporting design

• Access revocation, retention, lifecycle, and deletion design

• Solution options, feasibility, gap, dependency, and risk assessment

• POC architecture, implementation, test results, and recommendations

• Reusable implementation patterns and operational handover documentation

Requirements

• Strong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths.

• Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms.

• Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management.

• Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines.

• Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support.

• Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications.

• Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.

• Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills.

Nice to have

• Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies.

• Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated environment.

• Experience designing and executing security POCs and converting validated patterns into production-ready designs.

• Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data.

We offer

• Competitive compensation

• Remote work

• Flexible working hours

• Continuous education, mentoring, and professional development programs

• A team with an excellent tech expertise