{"schemaVersion":"jobsearcher.job.v1","id":"e4d5fd2c4c96ffd0811e7c6b","url":"https://jobsearcher.com/jobs/e4d5fd2c4c96ffd0811e7c6b","canonicalUrl":"https://jobsearcher.com/jobs/e4d5fd2c4c96ffd0811e7c6b","title":"AWS Data Security Architect","description":"The client needs the access model that would let a Databricks workspace profile data across their AWS accounts — from a governance standpoint, not a business one. A scanning identity with broad read access across a regulated estate attracts real scrutiny, and security approval lead times can exceed the length of this engagement. You exist to get that answer early, and in a form the client’s information security function will accept.You also own the single question that most shapes the recommendation: how much of the in-scope S3 estate is registered in the AWS Glue Data Catalog. Collibra’s S3 profiling depends on it, so that number largely decides the target-state option. Nobody currently knows it.What you will doEstablish AWS Glue Data Catalog coverage across the in-scope accounts and buckets and quantify the gap. This is the first deliverable, and it gates the option recommendation.Document how the incumbent product authenticates and reaches data today — cross-account roles, network paths, endpoints — as the baseline for any replacement.Design the least-privilege cross-account access model for a Databricks-based scanning workload: IAM roles and trust policies, S3 bucket policies, and cross-account KMS key policies.Design network access — VPC endpoints, PrivateLink, and serverless networking configuration as applicable.Produce security-review-ready documentation: data flows, trust boundaries, identities, permission scopes, data classification per flow, and compensating controls. Assume a formal threat model is required.Secure the information security review slot in week 1 rather than week 9, and steer the design through to approval.Identify a pre-approved non-production account and dataset in which the prototype can legitimately run.Author the security and governance model deliverable, and the operating model for running the scanning workload in production.What you need7+ years in cloud or data platform security architecture, with deep AWS.Cross-account IAM design: role and trust policy authoring, permission boundaries, condition keys, and least-privilege scoping for a deliberately broad-read workload.S3 security at depth — bucket policies, access points, and how they interact with cross-account roles.Cross-account KMS key policies and grants. This is the most missed failure point in cross-account scanning and will be probed at interview.AWS Glue Data Catalog and crawlers — what gets registered, what does not, classifier behavior, and Lake Formation permissions where in play.VPC endpoints, PrivateLink and private networking for managed data services.Databricks on AWS security, or a directly comparable managed-service security model.A track record of security designs that passed formal enterprise security or architecture review in a regulated organization — and the ability to describe how objections were closed.Nice to haveThreat modelling — STRIDE, data flow diagrams, or an equivalent structured method.Financial services or other regulated-sector security review experience.AWS Security Specialty or equivalent certification.Multi-account governance at scale — Control Tower, service control policies, hub-and-spoke topologies.Experience securing data discovery or DSPM-style scanning workloads.This role is notA general AWS landing-zone architect post — scope is the scanning access model and getting it approved. Not a security operations or incident response function. And not the approver: this role prepares and defends the design; the client approves it.","company":"VBeyond","rawCompany":"vbeyond","city":"Denver","state":"CO","isRemote":false,"isActive":false,"createdAt":"2026-10-19T11:05:15.349Z","occupations":[{"code":"15-1243.00","title":"Database Architects","slug":"database-architects"},{"code":"15-1243.01","title":"Data Warehousing Specialists","slug":"data-warehousing-specialists"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"541690","title":"Other Scientific and Technical Consulting Services","slug":"other-scientific-and-technical-consulting-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"AWS Data Security Architect","description":"The client needs the access model that would let a Databricks workspace profile data across their AWS accounts — from a governance standpoint, not a business one. A scanning identity with broad read access across a regulated estate attracts real scrutiny, and security approval lead times can exceed the length of this engagement. You exist to get that answer early, and in a form the client’s information security function will accept.You also own the single question that most shapes the recommendation: how much of the in-scope S3 estate is registered in the AWS Glue Data Catalog. Collibra’s S3 profiling depends on it, so that number largely decides the target-state option. Nobody currently knows it.What you will doEstablish AWS Glue Data Catalog coverage across the in-scope accounts and buckets and quantify the gap. This is the first deliverable, and it gates the option recommendation.Document how the incumbent product authenticates and reaches data today — cross-account roles, network paths, endpoints — as the baseline for any replacement.Design the least-privilege cross-account access model for a Databricks-based scanning workload: IAM roles and trust policies, S3 bucket policies, and cross-account KMS key policies.Design network access — VPC endpoints, PrivateLink, and serverless networking configuration as applicable.Produce security-review-ready documentation: data flows, trust boundaries, identities, permission scopes, data classification per flow, and compensating controls. Assume a formal threat model is required.Secure the information security review slot in week 1 rather than week 9, and steer the design through to approval.Identify a pre-approved non-production account and dataset in which the prototype can legitimately run.Author the security and governance model deliverable, and the operating model for running the scanning workload in production.What you need7+ years in cloud or data platform security architecture, with deep AWS.Cross-account IAM design: role and trust policy authoring, permission boundaries, condition keys, and least-privilege scoping for a deliberately broad-read workload.S3 security at depth — bucket policies, access points, and how they interact with cross-account roles.Cross-account KMS key policies and grants. This is the most missed failure point in cross-account scanning and will be probed at interview.AWS Glue Data Catalog and crawlers — what gets registered, what does not, classifier behavior, and Lake Formation permissions where in play.VPC endpoints, PrivateLink and private networking for managed data services.Databricks on AWS security, or a directly comparable managed-service security model.A track record of security designs that passed formal enterprise security or architecture review in a regulated organization — and the ability to describe how objections were closed.Nice to haveThreat modelling — STRIDE, data flow diagrams, or an equivalent structured method.Financial services or other regulated-sector security review experience.AWS Security Specialty or equivalent certification.Multi-account governance at scale — Control Tower, service control policies, hub-and-spoke topologies.Experience securing data discovery or DSPM-style scanning workloads.This role is notA general AWS landing-zone architect post — scope is the scanning access model and getting it approved. Not a security operations or incident response function. And not the approver: this role prepares and defends the design; the client approves it.","datePosted":"2026-10-19T11:05:15.349Z","dateModified":"2026-10-19T11:05:15.349Z","hiringOrganization":{"@type":"Organization","name":"VBeyond","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Denver","addressRegion":"CO","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"e4d5fd2c4c96ffd0811e7c6b"},"url":"https://jobsearcher.com/jobs/e4d5fd2c4c96ffd0811e7c6b"}}