> Markdown version of [/jobs/ext/4431846-data-security-engineer](https://www.wearedevelopers.com/jobs/ext/4431846-data-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Data Security Engineer

- **Company:** Southern New Hampshire University
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $97,000.0 - $155,000.0
- **Contract:** Permanent contract
- **Skills:** Business Analytics Applications, Microsoft Azure, Cloud Computing, Cloud Database, Cloud Engineering, Cyber Security, Databases, Continuous Integration, Information Engineering, Data Integration, Information Leak Prevention, Data Security, Data Systems, Relational Databases, Database Security, Information Security Management, Key Management, Microsoft SQL Server, SQL Azure, Network Protocols, PCI Data Security Standards, Role-Based Access Control, SQL Stored Procedures, SQL Databases, Enterprise Data Management, Policy as Code, Data Logging, Scripting, Data Classification, Data Ingestion, Core Api, Microsoft Fabric, Data Lakes, Information Technology, Enterprise Integration, Data Management, Databricks
- **Published:** October 20, 2026
- **Apply:** https://www.builtincolorado.com/job/data-security-engineer/11757274?handler=ApplyRedirect

## About the Role

* Academic Degree(s) and/ areas of study: Bachelor's degree in information technology, computer science, information security or related discipline.

Equivalent of experience in lieu of degree acceptable: Yes

 * Years of experience: 7+ years of experience in information security, cloud engineering, database engineering, data engineering, or a related field, including 2+ years focused on data protection or database security.
 * Professional Certification(s): none required.
 * Specialized knowledge:
 * The data protection lifecycle, including classification, encryption, key and secrets management, access and entitlement controls, monitoring, retention, and secure disposal.
 * Security capabilities of cloud data and analytics platforms and relational database platforms, including Azure SQL and SQL Server.
 * Azure identity, networking, storage, governance, and key management services, including relevant networking protocols and secure data-access paths.
 * Regulatory, contractual, and policy requirements that apply to institutional data, such as [FERPA, GLBA Safeguards Rule, PCI DSS, and applicable state breach notification laws].
 * Skills:
 * Proficiency with SQL, including the ability to assess queries, permissions, schemas, and database security configurations.
 * Hands-on implementation of classification, labeling, masking, data loss prevention (DLP), secure integration, monitoring, auditing, and logging controls in enterprise data environments.
 * Scripting and automation using platform APIs, infrastructure-as-code, or similar tooling to deploy and validate security controls.
 * Clear written and verbal communication with both technical and non-technical audiences.

## Description

The Data Security Engineer implements, operates, and helps improve the security controls that protect institutional data across the enterprise data estate, including analytics platforms such as Microsoft Fabric and Databricks, relational database platforms such as Azure SQL and SQL Server, and the pipelines and integrations that move data between them.

This is a hands-on engineering role in the data protection domain: encryption and key management, access and entitlement controls for data, data classification and labeling enforcement, masking and de-identification, database security configuration, and secure data pipeline engineering. You will work alongside other security engineers, Security Operations, Data & Analytics, Data Governance, Data Engineering, and other IT teams, and provides technical support and guidance to teams building or operating data solutions. You will report to the Deputy CISO.

You will work 100% remotely from any of our approved states.

What you'll do:

 * Implements and maintains data protection controls across the enterprise data estate, including classification and labeling enforcement, masking, tokenization, redaction, and de-identification, so that controls reflect institutional data sensitivity and regulatory requirements.
 * Configures and operates encryption controls for data at rest and in transit, including platform-native encryption, certificate management, customer-managed keys (CMK), and key rotation, and manages keys, secrets, and credentials using approved vaulting services and managed identities.
 * Implements least-privilege access models across data platforms, databases, workspaces, schemas, tables, pipelines, and service identities, and performs [quarterly] entitlement reviews to identify and remediate excessive or orphaned access.
 * Hardens security configurations for Microsoft Fabric, Databricks, Azure SQL, SQL Server, data lakes, and storage services, and assesses database permissions, schemas, stored procedures, queries, and audit settings for weaknesses that could expose or improperly alter institutional data.
 * Embeds security controls into data ingestion, transformation, orchestration, sharing, and export workflows, and secures the service identities, connectors, private endpoints, network paths, notebooks, jobs, and CI/CD processes that support them.
 * Protects non-production environments by provisioning synthetic data or controlled production-data extracts and enforcing approved masking and tokenization standards before data is copied out of production.
 * Automates control deployment, configuration assessment, evidence collection, and compliance validation using scripting, infrastructure-as-code (IaC), and platform APIs, and integrates data security telemetry with Security Operations to support investigation, containment, and corrective action for data-related security events.
 * Documents and communicates the work: creates and maintains implementation guides, configuration standards, control mappings, and runbooks; participates in threat modeling and secure design reviews; and provides hands-on technical support to teams designing, deploying, migrating, or troubleshooting data solutions.
 * Attendance, punctuality, and reliability are essential functions of this role
 * Other duties and responsibilities as assigned. Job responsibilities can change at any time, with or without notice.

Detailed responsibilities by domain

The eight primary duties above consolidate the following detailed scope.

Data security controls

 * Design, implement, and maintain reusable data protection controls that enforce institutional security requirements across the enterprise data estate.
 * Translate data classification, sensitivity, and regulatory requirements into enforceable controls, including labeling, masking, tokenization, redaction, and de-identification.
 * Evaluate control coverage and effectiveness, identify gaps or configuration drift, and coordinate remediation with control and platform owners.

Encryption and key management

 * Operate encryption controls for data at rest and in transit, including platform-native encryption, certificate management, customer-managed keys, key rotation, and separation-of-duties requirements.
 * Implement secure key, secret, and credential management patterns using approved vaulting services, managed identities, and automated lifecycle controls.

Identity and access controls

 * Implement least-privilege access models across data platforms, databases, workspaces, schemas, tables, pipelines, and service identities using role-based and attribute-based access control (RBAC and ABAC) where supported.
 * Conduct periodic entitlement reviews, identify excessive or orphaned access, and automate access validation and remediation workflows.

Platform, database, and pipeline security

 * Harden and maintain security configurations for Microsoft Fabric, Databricks, Azure SQL, SQL Server, data lakes, storage services, and supporting integration technologies.
 * Embed security controls into data ingestion, transformation, orchestration, sharing, and export workflows, including validation of source-to-target protection requirements.
 * Secure the infrastructure behind data integrations: service identities, connectors, private endpoints, and network paths.
 * Secure the workloads that run on that infrastructure: notebooks, jobs, and CI/CD pipelines.
 * Assess database permissions, schemas, stored procedures, queries, audit settings, and platform features for weaknesses that could expose or improperly alter institutional data.
 * Protect non-production environments through synthetic data, controlled production-data extracts, and enforcement of approved masking and tokenization standards.

Security operations, automation, and compliance

 * Integrate data security telemetry with enterprise security operations and support investigation, containment, evidence collection, and corrective action for data-related security events.
 * Automate control deployment, configuration assessment, and compliance validation through scripting, infrastructure-as-code, platform APIs, and policy-as-code.
 * Track control health metrics, analyze recurring findings and exceptions, and propose improvements based on data sensitivity, exposure, threat context, and business impact.
 * Support audits, risk assessments, and regulatory or contractual reviews by producing technical evidence that demonstrates the effectiveness of implemented controls.

Consulting, documentation, and collaboration

 * Provide hands-on technical support to teams designing, deploying, migrating, or troubleshooting data solutions.
 * Participate in threat modeling, secure design reviews, proof-of-concept evaluations, and technical risk assessments, identifying implementation risks and recommending practical control changes.
 * Create and maintain implementation guides, configuration standards, control mappings, runbooks, and operational procedures.
 * Participate in peer review and share practices that promote secure-by-design work across the enterprise data estate., Partner with sales teams to win strategic data security opportunities. Present technical solutions, gather customer requirements, lead product evaluations, configure solutions, and design evaluation test plans. The role requires extensive pre-sales experience, security and networking expertise, data protection and web technology knowledge, and collaboration across matrixed go-to-market and partner teams.
Top Skills: Ai ToolsCybersecurityData ProtectionNetworkingSaaSSaseWeb TechnologiesZscaler Zero Trust Exchange
SHI International Corp., Serve as a customer-facing data security expert supporting presales engagements, consulting with executive and technical stakeholders, educating sales teams, developing security offerings and collateral, creating lab use cases, and assisting with professional services statements of work. The role requires expertise in cybersecurity frameworks, data security technologies, solution selling, and major security platforms. It is remote within the TOLA region and involves up to 20% travel.
Top Skills: Ccie SecurityCcnp SecurityCcspCehCisCismCisspConcentricCptCwspCyeraData Detection & Response (Ddr)Data Loss Prevention (Dlp)Data Security Posture Management (Dspm)File EncryptionGiacHitrustMimecastNistProofpointSentraSscpVaronisZscaler
Proofpoint