The Data Security Engineer Journeyman protects sensitive data across enterprise data platforms and tools in a highly regulated government environment, with a focus on operational execution and continuous improvement of data protection controls. This role implements and maintains encryption, access controls, and monitoring capabilities to ensure compliant, secure handling of structured and unstructured data across the client environment. The engineer collaborates closely with governance, compliance, and engineering teams to conduct risk assessments, support audits, and enable secure data sharing and analytics use cases.
Key Responsibilities- Design and implement data security architectures, including encryption for data at rest and in transit, tokenization, and key management using services such as KMS and HSMs.
- Configure and administer fine-grained access controls (RBAC/ABAC), identity federation, and privileged access management across databases, data lakes, and analytic platforms.
- Develop, document, and enforce data classification schemes and handling procedures aligned to applicable regulatory frameworks (e.g., NIST, FISMA, FedRAMP, HIPAA where appropriate).
- Conduct data-centric risk assessments, threat modeling, and control validation activities for data stores, pipelines, and integrations, and track remediation of identified gaps.
- Implement, tune, and maintain data loss prevention (DLP), activity monitoring, and anomaly detection capabilities for structured and unstructured data assets.
- Perform security reviews of data pipelines, APIs, and third-party data-sharing agreements to mitigate exfiltration, leakage, and inappropriate data exposure risks.
- Monitor, investigate, and respond to data security incidents, including log analysis, forensics support, incident documentation, and remediation follow-up.
- Maintain system security plans, control documentation, and audit evidence to support inspections, continuous monitoring, and certification and accreditation activities.
- Deliver data security awareness training and guidance to engineering, data, and analytics teams on secure data handling, access, and sharing practices.
Required Qualifications- Bachelor's degree in Information Assurance, Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent relevant experience.
- Typically 3-6 years of experience in data security, cybersecurity engineering, or data platform security in enterprise or federal IT environments.
- Hands-on experience implementing encryption, key management, and access control solutions for cloud or on-premises data platforms.
- Demonstrated experience configuring and managing RBAC/ABAC, identity federation, and privileged access controls for data systems.
- Experience conducting data-centric risk assessments, threat modeling, and security reviews of databases, data pipelines, APIs, or integrations.
- Ability to obtain and maintain a SECRET security clearance as required by the client.
- U.S. citizenship required to support a U.S.-only, federal IT environment.
Preferred Qualifications- Experience with cloud-native data services security in AWS, Azure, or Google Cloud Platform, including IAM, KMS, and data-specific controls.
- Relevant security certifications such as Security+, CISSP, CCSP, or vendor-specific cloud security certifications.
- Experience implementing and operating DLP and data governance tools (e.g., Microsoft Purview, AWS Macie, BigID) in enterprise environments.
- Background working with highly regulated government or public sector environments and aligning controls to NIST, FISMA, FedRAMP, or similar frameworks.
Compensation RangesCompensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.
EEO RequirementsIt is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.
All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.
Physical Requirements
The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.
DisclaimerThe preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.
Never miss an opportunity! Create an alert based on the job you applied for.