Senior Data Security Solution Engineer

Workplace: remote Location : Quantori is an international team: we have colleagues who work not only from office but also remotely from all over the world. Responsibilities : 1. Technical and Database Assessment Review Data In-Licensing requirements, workflow maps, data flows, data lineage, entitlement rules, and dependency records. Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption. Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up. Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites. 2. Data-Level Authentication and Identity Integration Assess authentication for named users, service identities, workloads, and analytical tools accessing databases. Evaluate OAuth/OIDC or other identity- and token-based authentication directly to the database where supported by the selected technology. Design integration between enterprise identities, security groups, project groups, database principals, roles, and policy engines. Reduce reliance on shared or long-lived credentials where feasible and define secure credential or token handling for unavoidable exceptions. Align with tools currently available and identify gaps if any, 3. Fine-Grained Authorization and Data Firewalling Design database-level controls that restrict access to explicitly authorized users, groups, services, projects, or licensing populations. Design and implement row-level security, column-level security, dynamic masking, views, policy-based filtering, or equivalent controls as appropriate. Define isolation patterns for different licensed datasets and agreements while preserving permitted platform use for other users. Ensure controls are consistently enforced as close to the data layer as technically feasible and are not solely dependent on application logic. 4. Auditing, Monitoring, and Traceability Design database auditing to capture who accessed data, what was accessed, when access occurred, and which identity or service was used. Define logging for queries, exports, failed access attempts, permission changes, and privileged activity where supported and required. Integrate audit telemetry with appropriate monitoring and reporting capabilities and define retention and evidence requirements. Validate that audit records are searchable, attributable, protected from inappropriate modification, and useful for investigation. 5. Data Lifecycle, Revocation, and Deletion Design controls for access revocation when users change roles, leave a project, or when licensing rights expire. Design methods to identify and remove licensed data from primary stores and relevant downstream copies, extracts, caches, or derived stores. Address deletion implications for referential integrity, backups, archives, replication, recovery processes, and downstream consumers. Define validation, exception handling, and evidence mechanisms to demonstrate that required deletion activities were completed. 6. Solution Architecture and Engineering Translate requirements into current-state and target-state architectures, technical specifications, security patterns, and implementation plans. Compare solution options and document trade-offs across security, feasibility, performance, scalability, operability, cost, and technology constraints. Define database connectivity, policy-enforcement, identity, audit, monitoring, lifecycle, and integration components. Collaborate with database, IAM, security architecture, infrastructure, application, data platform, governance, and scientific teams. 7. POC Design and Execution Select suitable relational database and workflow candidates that represent Data In-Licensing scenarios and material technical risks. Define POC architecture, test data, test identities, success criteria, negative tests, performance considerations, and rollback approach. Implement and validate identity-based authentication, fine-grained authorization, data firewalling, auditing, access revocation, and deletion scenarios. Document outcomes, limitations, operational considerations, reusable patterns, and recommendations for broader adoption. What we expect : Expected Deliverables Technical assessment of databases, integrations, identities, and data flows Current-state database security and capability assessment Target-state data security architecture and detailed technical design Database authentication and identity-integration design Row-level, column-level, masking, and policy-enforcement design Data firewalling and licensed-dataset isolation pattern Audit, monitoring, traceability, and reporting design Access revocation, retention, lifecycle, and deletion design Solution options, feasibility, gap, dependency, and risk assessment POC architecture, implementation, test results, and recommendations Reusable implementation patterns and operational handover documentation Required Technical Skills and Experience Strong hands-on experience with relational databases, SQL, database architecture, schemas, roles, privileges, and access paths. Practical experience implementing database-level authorization, including row-level and column-level controls or equivalent fine-grained mechanisms. Strong knowledge of database authentication, IAM, OAuth 2.0, OIDC, tokens, service identities, workload identities, and secrets management. Experience designing secure database connectivity and integrations for applications, analytical tools, APIs, ETL/ELT, and data pipelines. Experience with database auditing, query/activity monitoring, centralized logging, alerting, and investigation support. Understanding of data lineage, lifecycle, retention, revocation, deletion, backup, archive, and recovery implications. Ability to evaluate heterogeneous database technologies and design platform-appropriate controls. Strong architecture, engineering, troubleshooting, documentation, and stakeholder-collaboration skills. Nice to have : Experience with enterprise data platforms, cloud or hybrid databases, data catalogs, access governance, and policy-enforcement technologies. Experience in pharmaceutical research, scientific data, intellectual property protection, data licensing, or another regulated environment. Experience designing and executing security POCs and converting validated patterns into production-ready designs. Knowledge of privacy, contractual-use restrictions, segregation, and evidence requirements affecting licensed data. We offer : Competitive compensation Remote work Flexible working hours Continuous education, mentoring, and professional development programs A team with an excellent tech expertise