Data Security, Access Governance & Data Platforms
Operating Data Platform (ODP) | Security & Access Architecture
Location: Irving, TX (Onsite)
Engagement Type: Contractor – Full-Time
Duration: Six-Month Fixed-Term Engagement
Experience: 12–15 Years
Delivery Scope: Requirements, access model design, configuration, testing, cutover, and initial production hypercare
Extension: Possible at the program's discretion
Job Summary
We are seeking a highly experienced Senior Business Analyst specializing in Data Security, Access Governance, and Enterprise Data Platforms to support the Security & Access Architecture workstream for a greenfield Operating Data Platform (ODP).
This role will lead the definition, design, and implementation of an enterprise-wide data access and entitlement model across multiple operating businesses. The ideal candidate combines deep expertise in information security, data platform access controls, identity governance, and senior-level business analysis with the ability to independently drive delivery across business, security, engineering, and governance stakeholders.
The successful candidate will own the access governance workstream from requirements elicitation and security model design through configuration, testing, production cutover, and initial hypercare.
Key Responsibilities
1. Enterprise Data Security & Access Architecture
Lead the design and implementation of the enterprise data security and entitlement model for the Operating Data Platform.
Define data classification taxonomies, role architecture, access hierarchies, and fine-grained access control policies.
Establish role-based, attribute-based, and policy-based access control frameworks aligned with enterprise security requirements.
Define catalog, schema, table, row-level, and column-level security controls.
Design data masking, tagging, and attribute-based policies to protect sensitive and regulated information.
Ensure least-privilege access, segregation of duties, privileged access, and emergency access requirements are incorporated into the security architecture.
2. Data Platform Security Implementation
Translate business and security requirements into implementable access control specifications.
Partner with data architects, platform engineers, and security teams to implement access controls across enterprise data platforms.
Support security model implementation across Microsoft Fabric, OneLake, Databricks Unity Catalog, Snowflake, or AWS Lake Formation.
Validate security configurations through functional testing, negative testing, and access scenario validation.
Support production readiness, cutover, and post-production access governance stabilization.
3. Identity & Access Governance
Partner with IAM and identity governance teams to define access provisioning and entitlement management processes.
Analyze enterprise directory structures, identity groups, roles, and access entitlements.
Conduct role mining, entitlement analysis, and access certification requirements.
Define HR-driven Joiner, Mover, and Leaver (JML) provisioning and deprovisioning workflows.
Collaborate with platforms such as Microsoft Entra ID, Saviynt, SailPoint, and Okta.
Establish access recertification, approval workflows, and periodic entitlement review processes.
4. Senior Business Analysis & Requirements Management
Facilitate workshops with business stakeholders, data owners, security teams, engineering teams, and governance functions.
Elicit, analyze, and document complex security and access governance requirements.
Develop Business Requirements Documents (BRDs), Functional Specifications, process flows, user stories, and acceptance criteria.
Define RACI matrices, requirements traceability, and business process documentation.
Translate complex technical security concepts into clear business requirements and implementation specifications.
Design and manage User Acceptance Testing (UAT), defect tracking, and business sign-off.
Utilize advanced Excel and SQL to analyze large entitlement datasets, identify access anomalies, and perform root-cause analysis.
5. Project & Workstream Management
Own the security and access governance workstream through a fixed delivery timeline.
Develop and manage workstream plans, milestones, dependencies, resources, risks, and deliverables.
Coordinate internal teams, external consultants, and business stakeholders without direct reporting authority.
Manage defects, implementation dependencies, cutover activities, and acceptance criteria.
Drive decisions and deliverables independently in a greenfield environment with evolving requirements.
Provide regular progress updates, risk assessments, and executive-level reporting.
6. Risk, Compliance & Audit Readiness
Ensure access governance requirements align with SOX IT General Controls (ITGC), segregation of duties, and access recertification requirements.
Support SOC 1 and SOC 2 control documentation and evidence expectations.
Develop audit-ready security policies, control narratives, access matrices, and supporting documentation.
Incorporate privacy, personally identifiable information (PII), and data residency requirements into access control design.
Partner with compliance and internal audit teams to validate control effectiveness and address security gaps.
7. Data Governance Partnership
Collaborate with data governance teams, data owners, stewards, and custodians.
Align security controls with enterprise data classification, sensitivity labeling, business glossary, and data catalog requirements.
Define the boundary between data governance policies and technical access enforcement.
Support governance integration with Microsoft Purview, Collibra, or Alation.
8. Executive & Stakeholder Communication
Present security risks, exposure assessments, remediation options, and recommendations to senior leadership.
Communicate effectively with CFO-level stakeholders and enterprise business leaders.
Facilitate discussions between business users and technical teams to balance security requirements with operational usability.
Drive stakeholder alignment and resolve competing access requirements across multiple business units.
Required Technical Skills & Qualifications
| Skill Area | Required Experience |
|---|
| Overall Experience | 12–15 years across information security, enterprise data, and business analysis |
| Data Security Architecture | Direct ownership of enterprise data platform access and entitlement models |
| Data Platforms | Microsoft Fabric, OneLake, Databricks Unity Catalog, Snowflake, or AWS Lake Formation |
| Fine-Grained Access Control | Catalog/schema privileges, row-level security, column-level security, masking, tag-based and attribute-based policies |
| IAM & IGA | Microsoft Entra ID, Saviynt, SailPoint, or Okta |
| Access Control Models | RBAC, ABAC, PBAC, role hierarchy, inheritance, least privilege, SoD, privileged and emergency access |
| Business Analysis | BRDs, functional specifications, user stories, acceptance criteria, process maps, RACI, traceability |
| Data Analysis | Advanced Excel and SQL for entitlement analysis and root-cause investigation |
| Project Management | Workstream ownership, delivery planning, dependencies, resources, defects, cutover, and acceptance |
| Compliance | SOX IT SOC 1, SOC 2, access recertification, audit documentation, privacy, and data residency |
| Data Governance | Data classification, ownership, stewardship, catalog, glossary, and sensitivity labeling |
| Communication | Executive-level presentations, stakeholder facilitation, and cross-functional leadership |
Preferred Qualifications
CISSP, CISM, CRISC, or CISA certification in good standing.
CDMP certification or vendor-specific data governance credential such as Collibra Ranger.
Current certification in Databricks, Snowflake, or Microsoft Azure data and security.
Experience designing access controls for AI and agentic consumption of governed data platforms.
Experience in private investment, technology infrastructure, or multi-entity, multi-jurisdiction enterprise environments.
PMP, PRINCE2, CBAP, or equivalent project management or business analysis certification.
