Senior Technical Data Security Architect

This is a fully remote position, open to applicants in United States.

📋 Description

• Create and manage comprehensive data security architecture across Azure, Microsoft Fabric, Azure Synapse Analytics, ADLS Gen2, and Databricks Lakehouse.

• Establish and implement enterprise data classification, labeling, and handling protocols that align with Microsoft Purview Information Protection.

• Develop reference architectures and security blueprints for data ingestion, transformation, storage, and consumption layers.

• Direct threat modeling efforts for data pipelines and analytics workloads.

• Implement Zero Trust data security across data platforms and integration points.

• Architect and oversee Microsoft Fabric permissions, sensitivity labels, and OneLake security.

• Design RBAC and ABAC strategies for Azure data services and Databricks.

• Operationalize Microsoft Purview for catalog governance, lineage, and sensitivity classification.

• Set up Azure Private Endpoints, VNet integration, and network security groups.

• Supervise encryption, Azure Key Vault, customer-managed keys, and data protection standards.

• Enforce Entra ID Conditional Access, PIM, and managed identities.

• Lead the implementation and optimization of Microsoft Defender for Cloud DSPM.

• Architect Databricks Unity Catalog, including workspace security, credential governance, OAuth, masking, fine-grained access controls, audit logging, workflows, notebooks, and job-cluster security.

• Review MLflow models and Feature Store configurations to identify data leakage risks.

• Ensure adherence to GDPR, CCPA, HIPAA, SOC 2 Type II, and PCI-DSS standards.

• Design audit trails and data-access logging architectures; perform risk assessments, gap analyses, and maturity evaluations.

• Maintain security runbooks, policies, and standards documentation.

• Coordinate Data Subject Access Requests (DSARs) and regulatory inquiries with legal, compliance, and privacy teams.

• Provide guidance to data engineering, analytics engineering, and BI teams throughout the development process.

• Lead security architecture review boards for new data projects, integrations, and platform modifications.

• Mentor engineers and architects; facilitate knowledge-sharing sessions and workshops.

• Collaborate with engineering managers and HR on competency frameworks, leveling guides, and certification pathways.

• Foster a data security community of practice.

• Work together with SecOps and SOC teams on detection rules, incident response playbooks, and forensic capabilities.

• Present security posture, risk findings, and remediation plans to executives and board-level stakeholders.

⛳️ Requirements

• Over 7 years of experience in data engineering, data architecture, or information security, with a minimum of 7 years specializing in data security architecture; or a Bachelor’s Degree and 3+ years of relevant experience, with at least 3 years focused on data security architecture.

• Extensive hands-on expertise with Azure Data Lake Storage Gen2, Azure Synapse Analytics, Azure Data Factory, Azure SQL Database, and Microsoft Fabric.

• Proficient in designing and implementing Databricks Unity Catalog, including workspace federation, metastore design, and fine-grained access control.

• Strong knowledge of Microsoft Purview, including data map configuration, classification rules, sensitivity labels, and policy enforcement.

• Expert-level understanding of Entra ID, Managed Identities, Conditional Access, PIM, and service principal governance.

• Practical experience with Azure Key Vault, customer-managed encryption keys, and secrets management integration.

• Familiarity with Zero Trust, least privilege, data minimization, and data governance frameworks.

• Experience with compliance programs such as GDPR, CCPA, HIPAA, SOC 2, and PCI-DSS as they relate to data platforms.

• Proficient in SQL and at least one of Python, PySpark, PowerShell, or Terraform for security automation.

• Experience in securing data workloads across Azure, AWS, and/or GCP multi-cloud environments.

• Hands-on knowledge of Snowflake data security, including RBAC/DAC, column-level and row-level security, dynamic data masking, network policies, Private Link, and Data Sharing governance.

• Experience supporting presales activities, including technical discovery, RFP/RFI responses, solution demonstrations, and client-facing proposals and statements of work.

• Strong written and verbal communication abilities.

• Preferred: active AZ-500, DP-203, Databricks Certified Data Engineer Professional, CISSP, or CISM certifications; experience with Microsoft Sentinel; Databricks Delta Sharing, Cleanroom, and cross-cloud governance; Terraform or Bicep; data mesh; AI/ML security; experience in regulated industries.

• Open to emerging technologies, including AI tools.

🏝️ Benefits

• Primarily a remote workforce; available to U.S. residents only.

• Up to 10% travel required.

• Group Medical Insurance options: Zero Deductible PPO Plan; GuidePoint covers 90% of employee premiums and 70% of family premiums.

• High Deductible Health Plan with HSA; GuidePoint covers 100% of employee premiums and 75% of family premiums.

• HSA contributions of $850 annually per employee or $1,750 annually per family.

• Group Dental Insurance; GuidePoint covers 100% of employee premiums and 75% of family premiums.

• 12 corporate holidays provided.

• Flexible Time Off (FTO) program available.

• Healthy allowance for mobile phone and home internet expenses.

• Eligibility for retirement plan after 2 months at open enrollment.

• Pet Benefit Option available.

• Opportunities for mentorship and guidance.