Senior Data Security Solution Engineer

Quantori; United States; A distancia; USD 140.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Competitive compensation

Education and mentoring

Professional development

Descripción de la vacante

Quantori is seeking a Senior Data Security Engineer to lead security design for databases, identity integration, and data access controls. You will work with Business Analysis teams to translate requirements into secure architectures and POC implementations.

The role involves configuring row-level and column-level security, auditing, and data lifecycle controls across licensing datasets, while collaborating with IAM, security, and data platform teams to deliver robust data protection.

Formación

• Strong hands-on experience with relational databases, SQL, and database architecture.
• Experience implementing database-level authorization, including row-level and column-level controls.
• Knowledge of IAM, OAuth 2.0, OIDC, tokens and secrets management.
• Experience designing secure database connectivity for applications, analytical tools, APIs, ETL/ELT, and data pipelines.
• Experience with database auditing, query monitoring, centralized logging, alerting, and investigation support.
• Understanding data lineage, lifecycle, retention, revocation, deletion, backups and recovery implications.
• Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.
• Strong architecture, engineering, troubleshooting, documentation and stakeholder-collaboration skills.

Responsabilidades

• Review data in-licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.
• Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.
• Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.
• Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.
• Assess authentication for named users, service identities, workloads, and analytical tools accessing databases.
• Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.
• Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.
• Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.
• Align with tools currently available and identify gaps if any.
• Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.
• Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.
• Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.
• Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.
• Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.
• Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.
• Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.
• Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.
• Design controls for access revocation when users change roles, leave a project, or when licensing rights expire.
• Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.
• Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.
• Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.
• Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.
• Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.
• Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.
• Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.
• Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.
• Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.
• Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.
• Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.

Conocimientos

Relational databases

SQL

Database architecture

IAM

OAuth 2.0

OIDC

Data lineage

Security auditing

Documentation

Descripción del empleo

We are seeking a Senior Data Security Engineer to analyze the current business goal along with the Business Analysis team, create a solution and implement it.

Location:

Quantori is an international team: we have colleagues who work not only from office but also remotely from all over the world.

Responsibilities:

Technical and Database Assessment

• Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.
• Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.
• Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.
• Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.

Data-Level Authentication and Identity Integration

• Assess authentication for named users, service identities, workloads, and analytical tools accessing databases.
• Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.
• Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.
• Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.
• Align with tools currently available and identify gaps if any,

Fine-Grained Authorization and Data Firewalling

• Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.
• Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.
• Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.
• Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.

Auditing, Monitoring, and Traceability

• Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.
• Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.
• Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.
• Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.

Data Lifecycle, Revocation, and Deletion

• Design controls for access revocation when users change roles, leave a project, or when licensing rights expire.
• Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.
• Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.
• Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.

Solution Architecture and Engineering

• Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.
• Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.
• Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.
• Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.

POC Design and Execution

• Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.
• Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.
• Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.
• Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.

What we expect:

• Technical assessment of databases, integrations, identities, and data flows
• Current-state database security and capability assessment
• Target-state data security architecture and detailed technical design
• Database authentication and identity-integration design
• Row-level, column-level, masking, and policy-enforcement design
• Data firewalling and licensed-dataset isolation pattern
• Audit, monitoring, traceability, and reporting design
• Access revocation, retention, lifecycle, and deletion design
• Solution options, feasibility, gap, dependency, and risk assessment
• POC architecture, implementation, test results, and recommendations
• Reusable implementation patterns and operational handover documentation

What we expect:

• Technical assessment of databases, integrations, identities, and data flows
• Current-state database security and capability assessment
• Target-state data security architecture and detailed technical design
• Database authentication and identity-integration design
• Row-level, column-level, masking, and policy-enforcement design
• Data firewalling and licensed-dataset isolation pattern
• Audit, monitoring, traceability, and reporting design
• Access revocation, retention, lifecycle, and deletion design
• Solution options, feasibility, gap, dependency, and risk assessment
• POC architecture, implementation, test results, and recommendations
• Reusable implementation patterns and operational handover documentation

Required Technical Skills and Experience

• Strong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths.
• Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms.
• Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management.
• Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines.
• Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support.
• Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications.
• Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.
• Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills.

Nice to have:

• Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies.
• Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated environment.
• Experience designing and executing security POCs and converting validated patterns into production-ready designs.
• Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data.

We offer:

• Competitive compensation
• Continuous education, mentoring, and professional development programs
• A team with an excellent tech expertise