Data Platform Security Engineer

北京汉克时代科技有限公司; Kuala Lumpur; On-site; MYR 120,000 - 210,000; Full time

Job summary

Beijing Hank时代科技有限公司 seeks an experienced security-focused cloud/data platform engineer to design and maintain access management as code across Azure, Snowflake, PostgreSQL, streaming and BI tools using Terraform.

You will implement data protection controls, secure monitoring, CI/CD security gates, and incident response processes, with English communication and occasional international travel.

Qualifications

• Bachelor's degree in Computer Science, Engineering, or equivalent.
• 3+ years in cloud or data platform engineering, including hands-on security work.
• Working understanding of GDPR principles (data minimisation, pseudonymisation, personal data handling).
• Fluent English; able to work Central European business hours and travel internationally at short notice.
• Security experience for Kafka, Event Hub, Service Bus, Flink, NiFi, Airflow, or Azure Functions.
• High availability/disaster recovery on Azure; managed service experience with a European client.

Responsibilities

• Access management as code across Azure, Snowflake, PostgreSQL, streaming and BI tools using Terraform with tiered access.
• Implement tiered access (full, masked, metadata-only) and just-in-time access.
• Data protection controls: masking, row-access policies, encryption, Key Vault, and API security.
• Secure remote access: locked-down virtual desktops, Private Link, network segmentation.
• Security monitoring: write detections in Splunk/Grafana and ensure audit logs are complete.
• CI/CD security: add security gates to pipelines and review new integrations before production.
• Incident response: handle security incidents and provide evidence for audits.

Skills

Security mindset

Incident response

Threat detection

Cloud security

RBAC design

Cross-functional collaboration

Education

Bachelor's degree in Computer Science, Engineering, or equivalent

Tools

Terraform

Azure DevOps

GitHub Actions

Key Vault

Snowflake

PostgreSQL

Flink

Job description

Access management as code – Build/maintain RBAC across Azure, Snowflake, PostgreSQL, streaming and BI tools using Terraform, with tiered access (full, masked, metadata-only) and just-in-time access.

Data protection controls – Masking and row-access policies, masked non-production data, encryption, Key Vault, and API security.

Secure remote access – Locked-down virtual desktops, Private Link, and network segmentation.

Security monitoring – Write detections in Splunk/Grafana and ensure audit logs are complete.

CI/CD security – Add security gates to pipelines and review new integrations before production.

Incident response – Handle security incidents (including on-call during peak periods) and produce technical evidence for audits.

Requirements

Bachelor's degree in Computer Science, Engineering, or equivalent.

3+ years in cloud or data platform engineering, including hands‑on security work.

Working understanding of GDPR principles (data minimisation, pseudonymisation, personal data handling).

Fluent English; able to work Central European business hours and travel internationally at short notice.

Security experience for Kafka, Event Hub, Service Bus, Flink, NiFi, Airflow, or Azure Functions.

High availability/disaster recovery on Azure; managed service experience with a European client.

Azure security: Entra ID (Conditional Access, PIM, managed identities), RBAC, VNets/NSGs, Private Link, Key Vault, Defender for Cloud, Azure Policy

Data platform security: Snowflake (roles, dynamic masking, row-access policies, audit history), PostgreSQL (roles, row-level security)

IaC & CI/CD: Terraform, Azure DevOps or GitHub Actions, secret and IaC scanning

Data governance: Microsoft Purview or equivalent (cataloguing, classification, sensitivity labels, DLP, lineage)

We provide end‑to‑end IT consulting, integration, software development, EIV/ODC projects, maintenance, testing, and staffing. Serving key industries worldwide, we deliver large‑scale solutions from Beijing.