Lead Data Security Solution Engineer

Exp: 10+ years

Location: Remote

Time zone: ET (US Eastern time)
Shift: Night Shift
Type: Fulltime​

Responsibilities:

1. Technical and Database Assessment
Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records.
Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption.
Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up.
Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites.
2. Data-Level Authentication and Identity IntegrationAssess authentication for named users, service identities, workloads, and analytical tools accessing databases.
Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology.
Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines.
Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions.
Align with tools currently available and identify gaps if any,
3. Fine-Grained Authorization and Data FirewallingDesign database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations.
Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate.
Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users.
Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic.
4. Auditing, Monitoring, and TraceabilityDesign database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used.
Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required.




Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements.
Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation.
5. Data Lifecycle, Revocation, and DeletionDesign controls for access revocation when users change roles, leave a project, or when licensing rights expire.
Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores.
Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers.
Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed.
6. Solution Architecture and EngineeringTranslate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans.
Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints.
Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components.
Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams.
7. POC Design and ExecutionSelect suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks.
Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach.
Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios.
Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption.
What we expect:Expected Deliverables
Technical assessment of databases, integrations, identities,



and data flows
Current-state database security and capability assessment
Target-state data security architecture and detailed technical design
Database authentication and identity-integration design
Row-level, column-level, masking, and policy-enforcement design
Data firewalling and licensed-dataset isolation pattern
Audit, monitoring, traceability, and reporting design
Access revocation, retention, lifecycle, and deletion design
Solution options, feasibility, gap, dependency, and risk assessment
POC architecture, implementation, test results, and recommendations
Reusable implementation patterns and operational handover documentation
Required Technical Skills and ExperienceStrong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths.
Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms.
Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management.
Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines.
Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support.
Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications.
Ability to evaluate heterogeneous database technologies and design platform-appropriate controls.
Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills.
Nice to have:
Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies.
Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated setting.
Experience designing and executing security POCs and converting validated patterns into production-ready designs.
Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data.

Pay: ₹3,000,000.00 - ₹3,500,000.00 per year

Work Location: Remote

📌 Lead Data Security Solution Engineer (India)
🏢 SPS Ventures
📍 India