Lead Data Security Engineer

We are seeking a Lead Data Security Engineer who bridges deep security engineering expertise with hands-on platform administration in modern cloud data analytics ecosystems. You will partner closely with data engineers, platform architects, and governance teams to ensure that our enterprise data estate remains secure, compliant, and fully governed.

Responsibilities

• Design, implement, and maintain security controls using Microsoft Entra ID
• Manage and configure Entra ID security groups, Privileged Identity Management (PIM), and Conditional Access policies
• Oversee and streamline the enterprise access request and approval workflows
• Establish and monitor comprehensive audit logging and retention frameworks
• Oversee logging across Entra sign-in logs, PIM activity, service principal activity, and Fabric audit logs to ensure robust threat detection and compliance tracking
• Administer service principal and secret lifecycle management securely via Azure Key Vault
• Ensure adherence to rotation schedules, least-privilege principles, and secure credential handling
• Implement robust export controls across Microsoft Fabric and Power BI
• Enforce sensitivity-label policies on exported content to prevent unauthorized data exfiltration
• Build and maintain granular row-level security (RLS) and column-level security (CLS) across Fabric Lakehouse and Warehouse items
• Implement classification-to-label automation to dynamically feed and maintain the platform's sensitivity model

Requirements

• 5+ years of hands-on experience with Microsoft Entra ID, Conditional Access policies, and PIM
• Expertise in Data Loss Prevention (DLP) implementation
• Strong, practical experience with Microsoft Fabric and Power BI security models
• Experience managing Azure Key Vault, service principals, and credential lifecycles
• Familiarity with audit logging setups, sign-in analysis, and compliance log retention
• Proficiency in English at a B2+ level

Nice to have

• Hands-on experience with adjacent enterprise data platforms such as Azure Synapse, Power BI Premium Administration, or Databricks with Unity Catalog
• Experience implementing automated data classification and sensitivity labeling frameworks