Data Security Engineer

Southern New Hampshire University; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

Southern New Hampshire University is seeking a Data Security Engineer to implement and operate controls protecting institutional data across the enterprise data estate, including Microsoft Fabric, Databricks, Azure SQL, and the pipelines and integrations that move data between them.

You will design encryption and key management, enforce least-privilege access, harden configurations, and integrate security into data ingestion and pipelines while collaborating with IT teams.

Qualifications

• Experience implementing data protection controls across large enterprise environments.
• Proficiency with encryption, key management, and access control practices.
• Ability to design and enforce RBAC/ABAC across data platforms.
• Familiarity with cloud analytics and data platforms such as Microsoft Fabric and Databricks.

Responsibilities

• Implements and maintains data protection controls across the enterprise data estate.
• Configures and operates encryption controls for data at rest and in transit.
• Implements least-privilege access models and conducts entitlement reviews.
• Harden security configurations for Fabric, Databricks, Azure SQL, and SQL Server.
• Embeds controls into data ingestion and ETL workflows and secures service identities.
• Automates deployment, assessment, and compliance validation using IaC and platform APIs.

Skills

Data security

Encryption & key management

RBAC/ABAC

Threat modeling

Tools

Microsoft Fabric

Databricks

Azure SQL

SQL Server

Job description

Southern New Hampshire University is a team of innovators. World changers. Individuals who believe in progress with purpose. Since 1932, our people-centered strategy has defined us — and helped us grow a team that now serves over 180,000 learners worldwide. Our mission to transform lives is made possible by talented people who bring diverse industry experience, backgrounds and skills to the university. And today, we're ready to expand our reach. All we need is you. Make an impact — from near or far

At SNHU, you'll have the option to work remotely in the following states: Alabama, Arizona, Arkansas, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Hampshire, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin and Wyoming. We ask that our remote employees have access to a reliable internet connection and a dedicated, properly equipped workspace that is free of distractions. Employees must reside in, and work from, one of the above approved states

The opportunity

The Data Security Engineer implements, operates, and helps improve the security controls that protect institutional data across the enterprise data estate, including analytics platforms such as Microsoft Fabric and Databricks, relational database platforms such as Azure SQL and SQL Server, and the pipelines and integrations that move data between them. This is a hands-on engineering role in the data protection domain: encryption and key management, access and entitlement controls for data, data classification and labeling enforcement, masking and de-identification, database security configuration, and secure data pipeline engineering. You will work alongside other security engineers, Security Operations, Data & Analytics, Data Governance, Data Engineering, and other IT teams, and provides technical support and guidance to teams building or operating data solutions. You will report to the Deputy CISO. You will work 100% remotely from any of our approved states

What you'll do:

• Implements and maintains data protection controls across the enterprise data estate, including classification and labeling enforcement, masking, tokenization, redaction, and de-identification, so that controls reflect institutional data sensitivity and regulatory requirements
• Configures and operates encryption controls for data at rest and in transit, including platform-native encryption, certificate management, customer-managed keys (CMK), and key rotation, and manages keys, secrets, and credentials using approved vaulting services and managed identities
• Implements least-privilege access models across data platforms, databases, workspaces, schemas, tables, pipelines, and service identities, and performs [quarterly] entitlement reviews to identify and remediate excessive or orphaned access
• Hardens security configurations for Microsoft Fabric, Databricks, Azure SQL, SQL Server, data lakes, and storage services, and assesses database permissions, schemas, stored procedures, queries, and audit settings for weaknesses that could expose or improperly alter institutional data
• Embeds security controls into data ingestion, transformation, orchestration, sharing, and export workflows, and secures the service identities, connectors, private endpoints, network paths, notebooks, jobs, and CI/CD processes that support them
• Protects non-production environments by provisioning synthetic data or controlled production-data extracts and enforcing approved masking and tokenization standards before data is copied out of production
• Automates control deployment, configuration assessment, evidence collection, and compliance validation using scripting, infrastructure-as-code (IaC), and platform APIs, and integrates data security telemetry with Security Operations to support investigation, containment, and corrective action for data-related security events
• Documents and communicates the work: creates and maintains implementation guides, configuration standards, control mappings, and runbooks; participates in threat modeling and secure design reviews; and provides hands-on technical support to teams designing, deploying, migrating, or troubleshooting data solutions
• Attendance, punctuality, and reliability are essential functions of this role
• Other duties and responsibilities as assigned. Job responsibilities can change at any time, with or without notice

The eight primary duties above consolidate the following detailed scope.

Data security controls

• Design, implement, and maintain reusable data protection controls that enforce institutional security requirements across the enterprise data estate
• Translate data classification, sensitivity, and regulatory requirements into enforceable controls, including labeling, masking, tokenization, redaction, and de-identification
• Evaluate control coverage and effectiveness, identify gaps or configuration drift, and coordinate remediation with control and platform owners

Encryption and key management

• Operate encryption controls for data at rest and in transit, including platform-native encryption, certificate management, customer-managed keys, key rotation, and separation-of-duties requirements
• Implement secure key, secret, and credential management patterns using approved vaulting services, managed identities, and automated lifecycle controls

Identity and access controls

• Implement least-privilege access models across data platforms, databases, workspaces, schemas, tables, pipelines, and service identities using role-based and attribute-based access control (RBAC and ABAC) where supported
• Conduct periodic entitlement reviews, identify excessive or orphaned access, and automate access validation and remediation workflows

Platform, database, and pipeline security

• Harden and maintain security configurations for Microsoft Fabric, Databricks, Azure SQL, SQL Server, data lakes, storage services, and supporting integration technologies
• Embed security controls into data ingestion, transformation, orchestration, sharing, and export workflows, including validation of source-to-target protection requirements
• Secure the infrastructure behind data integrations: service identities, connectors, private endpoints, and network paths