#1023 - Data Security Solution Engineer

Job brief - Opportunity only available for Latam Professionals We're looking for a hands-on Data Security Solutions Engineer to design and validate database-level security for licensed third-party data: identity-based authentication, fine-grained authorization, auditing, and access revocation/deletion. The role includes running POCs and turning validated patterns into reusable, production-ready designs. Responsibilities Technical and Database Assessment - Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records. - Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption. - Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up. - Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites. Data-Level Authentication and Identity Integration - Assess authentication for named users, service identities, workloads, and analytical tools accessing databases. - Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology. - Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines. - Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions. - Align with tools currently available and identify gaps if any Fine-Grained Authorization and Data Firewalling - Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations. - Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate. - Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users. - Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic. Auditing, Monitoring, and Traceability - Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used. - Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required. - Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements. - Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation. Data Lifecycle, Revocation, and Deletion - Design controls for access revocation when users change roles, leave a project, or when licensing rights expire. - Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores. - Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers. - Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed. Solution Architecture and Engineering - Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans. - Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints. - Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components. - Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams. POC Design and Execution - Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks. - Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach. - Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios. - Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption. Requirements - Strong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths. - Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms. - Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management. - Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines. - Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support. - Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications. - Ability to evaluate heterogeneous database technologies and design platform-appropriate controls. - Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills. Expected Deliverables - Technical assessment of databases, integrations, identities, and data flows - Current-state database security and capability assessment - Target-state data security architecture and detailed technical design - Database authentication and identity-integration design - Row-level, column-level, masking, and policy-enforcement design - Data firewalling and licensed-dataset isolation pattern - Audit, monitoring, traceability, and reporting design - Access revocation, retention, lifecycle, and deletion design - Solution options, feasibility, gap, dependency, and risk assessment - POC architecture, implementation, test results, and recommendations - Reusable implementation patterns and operational handover documentation Nice to have: - Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies. - Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated environment. - Experience designing and executing security POCs and converting validated patterns into production-ready designs. - Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data. What we offer: - Competitive salary in USD. - 100% Remote Work. - Contract type: Independent Contractor with Venon Solutions LLC. - Holidays: from the North American calendar. - Working hours: EST Time zone. Full-time, fully committed. Originally posted on Himalayas