Senior Data Security Architect — Data Licensing & Access

Quantori; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation

Education and mentoring

Professional development

Job summary

Quantori is seeking a Senior Data Security Engineer to lead security design for databases, identity integration, and data access controls. You will work with Business Analysis teams to translate requirements into secure architectures and POC implementations.

The role involves configuring row-level and column-level security, auditing, and data lifecycle controls across licensing datasets, while collaborating with IAM, security, and data platform teams to deliver robust data protection.

Qualifications

• Strong hands-on experience with relational databases, SQL, and database architecture.
• Experience implementing database-level authorization, including row-level and column-level controls.
• Knowledge of IAM, OAuth 2.0, OIDC, tokens and secrets management.
• Experience designing secure database connectivity for applications, analytical tools, APIs, ETL/ELT, and data pipelines.
• Experience with database auditing, query monitoring, centralized logging, alerting, and investigation support.
• Understanding data lineage, lifecycle, retention, revocation, deletion, backups and recovery implications.
• Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.
• Strong architecture, engineering, troubleshooting, documentation and stakeholder-collaboration skills.

Responsibilities

• Review data in-licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.
• Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.
• Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.
• Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.
• Assess authentication for named users, service identities, workloads, and analytical tools accessing databases.
• Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.
• Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.
• Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.
• Align with tools currently available and identify gaps if any.
• Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.
• Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.
• Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.
• Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.
• Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.
• Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.
• Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.
• Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.
• Design controls for access revocation when users change roles, leave a project, or when licensing rights expire.
• Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.
• Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.
• Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.
• Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.
• Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.
• Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.
• Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.
• Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.
• Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.
• Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.
• Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.

Skills

Relational databases

SQL

Database architecture

IAM

OAuth 2.0

OIDC

Data lineage

Security auditing

Documentation

Job description

Quantori is seeking a Senior Data Security Engineer to lead security design for databases, identity integration, and data access controls. You will work with Business Analysis teams to translate requirements into secure architectures and POC implementations.

The role involves configuring row-level and column-level security, auditing, and data lifecycle controls across licensing datasets, while collaborating with IAM, security, and data platform teams to deliver robust data protection.