Senior Business Analyst, Data Security & Access Governance Operating Data Platform (ODP) — Security & Access Architecture

Data Security, Access Governance & Senior Business Analyst

Operating Data Platform (ODP) — Security & Access Architecture 

The Position

Client is standing up the Operating Data Platform (ODP), a new enterprise data lake consolidating operating, finance, supply chain, and commercial data from across the group's ecosystem businesses. ODP is the foundation for enterprise reporting, analytics, and AI automation.

ODP consolidates data that is currently separated by system boundaries, removing that separation. Until the access model is designed and enforced, the platform's default posture is over-permissioned. Designing the model before the data lands is materially cheaper than retrofitting it, and that sequencing is this role's responsibility.

Requirements

•      12–15 years of progressive experience across information security and enterprise data, including direct ownership of an access or entitlement model for a system holding financially significant or otherwise regulated data. The band reflects scope rather than tenure: the role is accountable enterprise-wide across the group's operating businesses, is the subject matter expert across business, security, and engineering, sits in governance forums, and may be audit-facing. Project-scoped experience does not meet the bar.

•      Demonstrated design of a data platform security model. Prior accountability for the access and entitlement model of a data lake, or enterprise data warehouse — classification taxonomy, role architecture, and fine-grained controls — taken through testing into production.

•      Hands-on fine-grained data access control on at least one major platform: Microsoft Fabric, OneLake, Databricks Unity Catalog, Snowflake, or AWS Lake Formation. Specifically catalog and schema privilege design, row-level and column-level controls, masking, and tag-based or attribute-based policy. Depth in one platform with the ability to reason across the others.

•      Identity and access management fluency. Enterprise directory (Microsoft Entra ID or equivalent) and an identity governance platform such as Saviynt, SailPoint, or Okta, including role mining, entitlement analysis, access certification campaigns, and HR-driven joiner, mover, and leaver provisioning.

•      Access control models in substance. Role-based, attribute-based, and policy-based access control; role hierarchy and inheritance; least privilege; segregation of duties; privileged and emergency access design. Ability to defend a model choice on the specific facts.

•      Senior business analysis craft. Requirements elicitation and workshop facilitation across competing user groups; business requirements documents, functional specifications, process maps, user stories with acceptance criteria, RACI, and requirements traceability; UAT design and defect management. Advanced Excel and SQL sufficient to interrogate large entitlement datasets and establish root cause.

•      Project management accountability. Prior ownership of a workstream against a fixed date — plan, dependencies, resources, defects, cutover, and acceptance — directing a mixed team of internal resources, external consultants, and part-time business participants without direct line authority.

•      Control and compliance literacy. SOX IT general controls, segregation of duties, access recertification, and SOC 1 and SOC 2 evidence expectations, with the ability to author control documentation to audit standard. Working knowledge of privacy and data protection obligations as they constrain access design, including personally identifiable information handling and data residency.

•      Data governance partnership. Practical experience operating alongside a data governance function — data owners, stewards, and custodians; business glossary and catalog; classification and sensitivity labeling — and an understanding of where the governance boundary sits relative to access control. Exposure to Microsoft Purview, Collibra, or Alation.

•      Executive communication. Written and verbal communication appropriate to a CFO-level audience, including presenting a security exposure and remediation option set with a recommendation. The role also communicates continuously with business users who will experience the access model as friction.

•      Independence. Capacity to operate on a greenfield platform where the authoritative answer frequently does not yet exist, and to convert direction from senior leadership into closed deliverables without extensive oversight.

Preferred

• One of CISSP, CISM, CRISC, or CISA in good standing.
• CDMP (DAMA Certified Data Management Professional) or a vendor data governance credential such as Collibra Ranger.
• A current platform credential on the selected ODP platform — Databricks, Snowflake, or Microsoft Azure data and security.
• Experience designing access controls for AI and agentic consumption of a governed data platform.
• Experience in private investment, technology infrastructure, or a comparable multi-entity, multi-jurisdiction group environment.
• Recognized delivery or business analysis credential (PMP, PRINCE2, CBAP, or equivalent).