security engineer for data licensing

EPAM; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Повышение по результатам работы

Возможности обучения и сертификации (G

Job summary

EPAM ищет опытного архитектора баз данных для руководства проектами по безопасной работе с данными в рамках глобальных инициатив. Вы будете проектировать аутентификацию, управление доступом и аудит БД, взаимодействуя с командами IAM, безопасности и инфраструктуры.

Кандидат должен обладать сильной экспертизой по реляционным базам данных, SQL и архитектуре БД, а также знанием IAM, OAuth/OIDC и механизмов аудита.

Qualifications

• 5+ лет опыта, включая руководящую роль
• Практика с реляционными базами данных, SQL и архитектурой БД
• Опыт реализации авторизации на уровне БД
• Знание аутентификаций OAuth 2.0, OIDC, токены
• Опыт аудита БД, мониторинга запросов и централизованного логирования
• Умение работать с данными: линейка данных, хранение, резервное копирование

Responsibilities

• Рассматривать требования по лицензированию данных, карты процессов и цепочки данных; оценивать базы и схемы, подключения и patterns запросов
• Разрабатывать аутентификацию для пользователей и сервисов; интегрировать идентификацию и политику доступа
• Проектировать контроль доступа на уровне БД: row-level, column-level, маскирование данных и представления
• Разрабатывать аудит БД: логирование, трассировка и алёрты; интегрировать телеметрию аудита
• Определять требования по жизненному циклу данных, хранению, архивам и резервному копированию

Skills

Relational databases

SQL

Database architecture

IAM/OAuth/OIDC

Security auditing

Data governance

Leadership

English proficiency

Job description

Описание:

EPAM delivers AI transformation engineering and integrated consulting to Forbes Global 2000 companies and ambitious startups. It provides custom software, product, and platform engineering to help clients become AI-Native enterprises and generate value from innovation and digital investments.

Задачи:

Review Data In-Licensing requirements, workflow maps, data flows, entitlement rules, and dependency records; assess relational database platforms, schemas, connectivity methods, and query patterns; identify where licensed data is stored, transformed, replicated, extracted, or backed up Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites Design authentication for named users, service identities, workloads, and analytical tools accessing databases; evaluate OAuth/OIDC or token-based authentication; integrate enterprise identities, security groups, and database principals; reduce reliance on shared or long-lived credentials Design database-level controls that restrict access to authorized users, groups, services, or licensing populations; implement row-level security, column-level security, dynamic masking, views, or policy-based filtering; ensure controls are enforced at the data layer rather than relying solely on application logic Design database auditing to capture who accessed data, what they accessed, when, and which identity was used; define logging for queries, exports, failed attempts, and permission changes; integrate audit telemetry with monitoring and reporting; ensure audit records are searchable, protected, and useful for investigations Design access-revocation controls for role changes or expired licensing rights; design methods to identify and remove licensed data from primary stores and downstream copies; address deletion implications for backups, archives, replication, and referential integrity; define validation and evidence mechanisms Translate requirements into architectures, technical specifications, and implementation plans; compare solution options across security, feasibility, performance, scalability, and cost; collaborate with database, IAM, security architecture, infrastructure, application, and governance teams Select database and workflow candidates for POCs; define POC architecture, test data, success criteria, and rollback approach; implement and validate authentication, fine-grained authorization, auditing, revocation, and deletion scenarios; document outcomes, limitations, and recommendations

Требования:

5+ Years of relevant experience, including at least 1 year in a leadership role Strong hands-on experience with relational databases, SQL, and database architecture, including schemas, roles, privileges, and access paths Practical experience implementing database-level authorization, including row-level and column-level controls or fine-grained mechanisms Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications Ability to evaluate heterogeneous database technologies and design platform-appropriate controls Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills English proficiency at an Upper-Intermediate level (B2) or higher Будет плюсом: Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies; experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or regulated environments; experience designing and executing security POCs and converting validated patterns into production-ready designs; knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data

Условия:

Opportunity to work abroad for up to two months per year Relocation opportunities within EPAM offices in 55+ countries Leadership development, career advising, soft skills, and well-being programs Certifications, including GCP, Azure, and AWS Unlimited access to EPAM's internal learning database Free English classes with certified teachers Participation in the Employee Stock Purchase Plan Monetary bonuses for engaging in the referral program Comprehensive medical and family care package Four trust days per year for personal needs Discounts for fitness clubs Benefits package covering hotels, restaurants, stores, and services Remote work locations: Armenia, Georgia, Kazakhstan, Kyrgyzstan, Uzbekistan