AWS Data Security Architect

The client needs the access model that would let a Databricks workspace profile data across their AWS accounts — from a governance standpoint, not a business one. A scanning identity with broad read access across a regulated estate attracts real scrutiny, and security approval lead times can exceed the length of this engagement. You exist to get that answer early, and in a form the client’s information security function will accept.

You also own the single question that most shapes the recommendation: how much of the in-scope S3 estate is registered in the AWS Glue Data Catalog. Collibra’s S3 profiling depends on it, so that number largely decides the target-state option. Nobody currently knows it.

What you will do

• Establish AWS Glue Data Catalog coverage across the in-scope accounts and buckets and quantify the gap. This is the first deliverable, and it gates the option recommendation.
• Document how the incumbent product authenticates and reaches data today — cross-account roles, network paths, endpoints — as the baseline for any replacement.
• Design the least-privilege cross-account access model for a Databricks-based scanning workload: IAM roles and trust policies, S3 bucket policies, and cross-account KMS key policies.
• Design network access — VPC endpoints, PrivateLink, and serverless networking configuration as applicable.
• Produce security-review-ready documentation: data flows, trust boundaries, identities, permission scopes, data classification per flow, and compensating controls. Assume a formal threat model is required.
• Secure the information security review slot in week 1 rather than week 9, and steer the design through to approval.
• Identify a pre-approved non-production account and dataset in which the prototype can legitimately run.
• Author the security and governance model deliverable, and the operating model for running the scanning workload in production.

What you need

• 7+ years in cloud or data platform security architecture, with deep AWS.
• Cross-account IAM design: role and trust policy authoring, permission boundaries, condition keys, and least-privilege scoping for a deliberately broad-read workload.
• S3 security at depth — bucket policies, access points, and how they interact with cross-account roles.
• Cross-account KMS key policies and grants. This is the most missed failure point in cross-account scanning and will be probed at interview.
• AWS Glue Data Catalog and crawlers — what gets registered, what does not, classifier behavior, and Lake Formation permissions where in play.
• VPC endpoints, PrivateLink and private networking for managed data services.
• Databricks on AWS security, or a directly comparable managed-service security model.
• A track record of security designs that passed formal enterprise security or architecture review in a regulated organization — and the ability to describe how objections were closed.

Nice to have

• Threat modelling — STRIDE, data flow diagrams, or an equivalent structured method.
• Financial services or other regulated-sector security review experience.
• AWS Security Specialty or equivalent certification.
• Multi-account governance at scale — Control Tower, service control policies, hub-and-spoke topologies.
• Experience securing data discovery or DSPM-style scanning workloads.

This role is not

A general AWS landing-zone architect post — scope is the scanning access model and getting it approved. Not a security operations or incident response function. And not the approver: this role prepares and defends the design; the client approves it.