Databricks Unity Catalog Admin

Canadian Tire Financial Services; Toronto; Hybrid; CAD 64,000 - 106,000; Full time

Benefits offered by this job

Comprehensive benefits and retirement

Performance incentives

Continuing Education Programs

Career growth opportunities

Product discounts

Job summary

Canadian Tire Financial Services seeks a Unity Catalog Administrator to design and automate enterprise data governance across the Databricks ecosystem. You will standardize catalog metadata, integrate Entra ID, audit compliance, and deploy across multi-workspace architectures.

You will implement and maintain Row-Level Security, Column-Level Masking, and secure data sharing protocols while enforcing naming standards and environment isolation for Dev, QA, Stage, and Prod.

Qualifications

• Experience designing and governing Unity Catalog, Delta Lake, and data sharing.
• Proficiency with Terraform Databricks Provider and GitOps workflows.
• Strong understanding of RBAC, ABAC, and data masking for PII/PHI data.

Responsibilities

• Design, automate, and maintain Unity Catalog governance across environments.
• Automate deployment of catalogs, schemas, and permissions via GitOps.
• Enforce identity federation, access controls, and data privacy standards.

Skills

Unity Catalog

GitOps CI/CD

RBAC/ABAC

SQL Admin

Tools

Terraform

PowerShell

Azure IAM

GCP IAM

Job description

## Databricks Unity Catalog AdminApply: Toronto, ON: Full time: Posted 2 Days Ago: End Date: October 14, 2026 (11 days left to apply): JR165322**What You’ll Do:** The Unity Catalog Administrator will design, automate, and maintain the global data governance, infrastructure provisioning, and security model across the enterprise Databricks ecosystem. This role ensures data assets are systematically standardized, securely cataloged via Entra ID integration, audited for regulatory compliance, and programmatically deployed across multi-workspace architectures. * **Infrastructure Provisioning**: Architect and maintain the global Unity Catalog Metastore, external cloud storage locations, storage credentials, and managed UC Volumes.* **Enterprise Automation**: Programmatically deploy and manage all catalogs, schemas, external locations, and permissions schemas using a GitOps framework with Terraform.* **Access & Identity Control**: Enforce identity federation with Microsoft Entra ID, manage fine-grained object privileges (SELECT, MODIFY, MANAGE), and govern group assignments.* **Standards & Policy Enforcement**: Define and enforce enterprise-wide standards for naming conventions, metadata tagging, and strict Workspace-Catalog isolation boundaries across environments (Dev, QA, Stage, Prod).* **Advanced Data Protection**: Implement and maintain scalable Row-Level Security (RLS) and Column-Level Masking routines to safeguard sensitive PII/PHI datasets.* **Compliance, Lineage & Auditing**: Proactively monitor Unity Catalog System Tables (system.access.audit, system.billing.usage) and map end-to-end data lineage for regulatory compliance.* **Data Sharing Frameworks**: Configure, manage, and audit Delta Sharing protocols and clean rooms to enable secure, zero-copy data exchange with external partners.* **Cross-Cloud Automation & GitOps:** Programmatically deploy and govern all catalogs, schemas, external storage locations, and access control lists (ACLs) using a unified CI/CD GitOps pipeline. Enforce drift detection for manual permission mutations made in either the Azure or GCP Databricks UI. **What You Bring:** * **Databricks Governance Architecture:** Deep architectural expertise in Unity Catalog, Delta Lake, Delta Sharing, System Tables.* **Automation & GitOps CI/CD:** Experience with Terraform (specifically the Databricks Provider) and PowerShell for automated, repeatable environment deployments and state management is considered an asset.* **Advanced Data Security:** Practical experience designing and implementing Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Row-Level Security (RLS), and Column-Level Data Masking.* **Data Strategy & Querying:** Proficient in SQL (specifically administrative DDL for GRANTS/REVOKES) and familiar with enterprise data lifecycle management.* **Azure Infrastructure & Identity:** Hands-on proficiency with Microsoft Entra ID (SCIM/AIM provisioning, group syncing), Azure IAM (User-Assigned Managed Identities, Access Connectors), and Azure Key Vault.* **GCP Infrastructure & Identity:** Hands-on proficiency with Google Cloud Identity, IAM Service Accounts (with Workload Identity Federation), Manage SSO Integration, Google Cloud Storage (GCS) buckets, and GCP Workload Identity Federation. **Location:** Toronto, Ontario (Hybrid: In-office 4 days a week) We’re always looking for great talent! In addition to competitive pay, we offer:* Comprehensive benefits and retirement programs* Performance incentives, Continuing Education Programs* Other perks to support your well-being* Career growth opportunities and product discounts **Broadband Salary Range:** $64,000 – $106,000 Our typical *hiring range* is between $64,000 and $85,000. Salary decisions are also dependent on other factors such as your experience, industry benchmarks, internal equity and other role-specific requirements. For critical roles, the compensation offering will be reviewed to ensure alignment with market rate and conditions and the unique value you bring to the role.#LI-AK1This posting represents an existing vacancy within our organization.We may use artificial intelligence tools as part of our recruitment process to assist in the initial screening of resumes. All hiring decisions, including candidate evaluation, selection, and disposition, are made by human recruiters.