POSITION SUMMARY:Targa is seeking a hands-on Data Security Sr. Analyst to own the security and access model for the enterprise data and analytics platform. This role decides who can see and use which data, puts those decisions into enforced controls, and makes sure the platform stays compliant as more people, more data sources, and more AI use it.
This Sr. Analyst owns data security policy and Microsoft Purview governance for the platform - classification, sensitivity labels, access policies, and audit - across Microsoft Fabric and Databricks, working with the Platform / Fabric Administrator, who runs Purview day to day, and with enterprise cybersecurity. The scope covers enterprise, OT, and third-party data, including privacy-sensitive HR and financial data. As AI assistants and agents can find and combine data faster than any person, this role is central to using AI safely: making sure every person, assistant, and agent sees only what it should, and that Targa can prove it.
JOB FUNCTIONS AND KEY RESPONSIBILITIES:- Design and maintain the data access model across workspaces, data products, and layers, based on roles and least privilege.
- Define row-level, object-level, and column-level security patterns for sensitive data across Microsoft Fabric, Power BI, and Databricks (Unity Catalog).
- Own access requests, approvals, and periodic access reviews for the data platform, moving from manual, workspace-by-workspace access toward automated, policy-based access at scale.
- Govern identities and credentials for non-human access, including service principals, managed identities, gateway credentials, and secrets in Azure Key Vault, with defined scope, rotation, and audit.
- Define the data classification scheme and sensitivity labels and how they are applied; use AI-assisted, policy-based classification to label data at scale, setting the rules and validating the results.
- Set access policies and data loss prevention controls in Purview, implemented with the Platform / Fabric Administrator.
- Define encryption, key management, and network isolation standards for the data platform, including encryption at rest and in transit, private endpoints, and Fabric private links.
- Refine and expand the guardrails that let citizen developers find and use data safely.
- Define how Copilot, AI assistants, and AI agents are allowed to access data; ensure permissions and labels are accurate enough that AI does not overshare sensitive data.
- Define identity, scope, and audit trail requirements for AI agents acting on behalf of people or on their own.
- Implement AI-specific data security controls, such as Purview Data Security Posture Management for AI, to monitor what data flows into prompts and responses.
- Secure OT data flows from the industrial network into the platform, partnering with the Data Ingestion Lead (Enterprise & OT) and OT cybersecurity on IT/OT boundaries, approved connectivity, and data diodes or brokers; work with the owners of TSA pipeline security directive compliance on how OT data leaves the control network.
- Own security of inbound third-party data from customers, suppliers, and data providers, and of outbound data sharing and external guest access, including the data-sharing and contract terms that govern both.
- Define handling standards for privacy-sensitive data, including PII, employee, and payroll data from systems such as UKG and financial data from Oracle, and ensure compliance with applicable privacy requirements.
- Own data platform controls that support SOX and other compliance requirements, including evidence for audits.
- Support retention, legal hold, and eDiscovery requirements for platform data with Legal and Records Management.
- Monitor access and activity for unusual or risky behavior using AI-based detection, and own the data-exposure incident playbook, coordinating response with the cybersecurity team.
- Write and maintain data security standards and procedures for the platform.
- Work with enterprise cybersecurity and identity teams on identity, threat, and incident response.
- Guide Data Management and Data Solutions on secure design for pipelines, data products, and semantic models.
- Work with data owners to classify data and approve access appropriately.
- Establish and report metrics for share of platform data classified and labeled, access reviews completed on schedule with no material audit findings, access requests handled within agreed time and policy, data security incidents and oversharing exposures identified and closed, and oversharing risks remediated before Copilot or agent rollout to each data domain.
- Other duties as assigned.
MINIMUM ESSENTIAL QUALIFICATIONS:- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field; equivalent relevant experience will be considered.
- 5+ years in information security, identity and access management, or data platform roles, including at least 3 years focused on data security.
- Hands-on experience with Microsoft Purview (information protection, data classification, sensitivity labels, DLP, or data governance).
- Strong knowledge of Entra ID (Azure AD), role-based access control, security groups, and conditional access.
- Experience managing non-human identities, including service principals, managed identities, and secrets management (Azure Key Vault).
- Experience implementing row-level and object-level security in Power BI, Fabric, or similar platforms.
- Experience supporting SOX or similar compliance controls, access reviews, and audit evidence.
- Ability to turn policy into practical controls and explain them clearly to technical and business audiences.
- Strong communication, problem-solving, and stakeholder-management skills.
- Regular and reliable attendance.
PREFERRED QUALIFICATIONS:- Experience securing Microsoft Fabric or Azure data platforms, including private endpoints and network isolation.
- Experience with Databricks Unity Catalog security.
- Experience governing Copilot or other AI tools in an enterprise, including identity and access for AI agents.
- Experience with Defender for Cloud Apps or Purview Data Security Posture Management for AI.
- Experience with AI risk frameworks and responsible AI controls.
- Experience with privacy requirements and protecting PII and HR data.
- Familiarity with OT/IT security concerns in industrial environments, including TSA pipeline security directives.
- Experience in energy, midstream, or other regulated, asset-intensive industries.
- Security certifications such as CISSP, CCSP, Microsoft SC-401 / Information Protection Administrator, or Azure Security Engineer.
EQUAL EMPLOYMENT OPPORTUNITY:Targa Resources provides equal employment opportunities based on merit, experience, and other work-related criteria and without regard to race, color, ethnicity, religion, national origin, sex, age, pregnancy, disability, veteran status, or any other status protected by applicable law. We also strive to provide reasonable accommodation to employees' beliefs and practices that do not conflict with Targa's policies and applicable law. We value the unique contributions that every employee brings to their role with Targa.
