data security eng sr

Location:

Responsibilities:

• Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.
• Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.
• Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.
• Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.

• Assess authentication for named users, service identities, workloads, and analytical tools accessing databases.
• Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.
• Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.
• Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.
• Align with tools currently available and identify gaps if any,

• Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.
• Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.
• Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.
• Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.

• Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.
• Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.
• Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.
• Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.

• Design controls for access revocation when users change roles, leave a project, or when licensing rights expire.
• Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.
• Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.
• Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.

• Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.
• Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.
• Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.
• Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.

• Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.
• Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.
• Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.
• Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.

What we expect:

• Technical assessment of databases, integrations, identities, and data flows
• Current-state database security and capability assessment
• Target-state data security architecture and detailed technical design
• Database authentication and identity-integration design
• Row-level, column-level, masking, and policy-enforcement design
• Data firewalling and licensed-dataset isolation pattern
• Audit, monitoring, traceability, and reporting design
• Access revocation, retention, lifecycle, and deletion design
• Solution options, feasibility, gap, dependency, and risk assessment
• POC architecture, implementation, test results, and recommendations
• Reusable implementation patterns and operational handover documentation

• Strong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths.
• Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms.
• Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management.
• Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines.
• Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support.
• Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications.
• Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.
• Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills.

Nice to have:

• Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies.
• Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated environment.
• Experience designing and executing security POCs and converting validated patterns into production-ready designs.
• Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data.

We offer:

• Competitive compensation
• Remote work
• Flexible working hours
• Continuous education, mentoring, and professional development programs
• A team with an excellent tech expertise