Data Security Engineer - Secret Clearance

The Data Security Engineer Journeyman protects sensitive data across enterprise data platforms and tools in a highly regulated government environment, with a focus on operational execution and continuous improvement of data protection controls. This role implements and maintains encryption, access controls, and monitoring capabilities to ensure compliant, secure handling of structured and unstructured data across the client environment. The engineer collaborates closely with governance, compliance, and engineering teams to conduct risk assessments, support audits, and enable secure data sharing and analytics use cases., * Design and implement data security architectures, including encryption for data at rest and in transit, tokenization, and key management using services such as KMS and HSMs.

• Configure and administer fine-grained access controls (RBAC/ABAC), identity federation, and privileged access management across databases, data lakes, and analytic platforms.
• Develop, document, and enforce data classification schemes and handling procedures aligned to applicable regulatory frameworks (e.g., NIST, FISMA, FedRAMP, HIPAA where appropriate).
• Conduct data-centric risk assessments, threat modeling, and control validation activities for data stores, pipelines, and integrations, and track remediation of identified gaps.
• Implement, tune, and maintain data loss prevention (DLP), activity monitoring, and anomaly detection capabilities for structured and unstructured data assets.
• Perform security reviews of data pipelines, APIs, and third-party data-sharing agreements to mitigate exfiltration, leakage, and inappropriate data exposure risks.
• Monitor, investigate, and respond to data security incidents, including log analysis, forensics support, incident documentation, and remediation follow-up.
• Maintain system security plans, control documentation, and audit evidence to support inspections, continuous monitoring, and certification and accreditation activities.
• Deliver data security awareness training and guidance to engineering, data, and analytics teams on secure data handling, access, and sharing practices.

• Bachelor’s degree in Information Assurance, Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent relevant experience.
• Typically 3-6 years of experience in data security, cybersecurity engineering, or data platform security in enterprise or federal IT environments.
• Hands-on experience implementing encryption, key management, and access control solutions for cloud or on-premises data platforms.
• Demonstrated experience configuring and managing RBAC/ABAC, identity federation, and privileged access controls for data systems.
• Experience conducting data-centric risk assessments, threat modeling, and security reviews of databases, data pipelines, APIs, or integrations.
• Must have a current SECRET security clearance as required by the client.
• U.S. citizenship required to support a U.S.-only, federal IT environment.
• Candidates must have a DoD 8140 compliant certification at the IAT-II level such as Security+.

Preferred Qualifications

• Experience with cloud-native data services security in AWS, Azure, or GCP, including IAM, KMS, and data-specific controls.
• Relevant security certifications such as Security+, CISSP, CCSP, or vendor-specific cloud security certifications.
• Experience implementing and operating DLP and data governance tools (e.g., Microsoft Purview, AWS Macie, BigID) in enterprise environments.
• Background working with highly regulated government or public sector environments and aligning controls to NIST, FISMA, FedRAMP, or similar frameworks.