Data Security Architect

Data Security Architect1. Job Details

• Job Title: Data Security Architect
• Location: Remote
• Duration: 12 months
• Work Model: Primarily remote, with a few onsite visits per month in Westbrook, Maine
• Primary Focus: Data Security Architecture, Data Loss Prevention (DLP), Data Security Posture Management (DSPM), Snowflake Security, and Data Governance

2. Job Summary

Clint is seeking an experienced Data Security Architect to help build and mature its enterprise data security program. This professional will define how sensitive data is classified, accessed, governed, and protected across complex enterprise environments, regardless of where the data resides.

This is an architecture-focused role rather than a tool administration position. The architect will translate business requirements and data-related risks into enterprise security standards, reference architectures, and reusable protection patterns that engineering teams can implement.

The ideal candidate will have a strong foundation in DLP and enterprise data protection, along with experience designing data security architecture, classification and governance standards, access-control models, and integrated security controls. The role will also contribute to Clint emerging DSPM capabilities and initial data security architecture service blueprint.

3. Key Responsibilities

• Design and develop enterprise data security architecture, standards, and reference models across complex data environments.
• Develop an initial data security architecture service blueprint to guide the enterprise data security program.
• Define reusable data protection patterns and security standards that engineering teams can implement.
• Establish data classification, tagging, cataloging, and governance approaches for sensitive enterprise data.
• Define data access-control models and determine appropriate controls based on data sensitivity and business risk.
• Evaluate and define the appropriate use of encryption, masking, tokenization, and other data protection mechanisms.
• Design Snowflake security and data governance integrations.
• Integrate identity, data, platform, and cloud security controls into a cohesive enterprise architecture.
• Define how DLP, DSPM, CASB, data governance, and identity controls should work together.
• Partner with engineering teams, application teams, business users, vendors, and technical stakeholders to translate architecture into implementation.
• Provide technical guidance and architectural direction to DLP engineers, vendors, and internal implementation teams.
• Communicate security risks, architectural decisions, and recommended controls in business-friendly terms.
• Influence stakeholders and drive adoption of data security standards across engineering and business teams.

4. Minimum Qualifications and Experience

• Demonstrated experience designing enterprise data security architecture across complex data environments.
• Strong foundation in Data Loss Prevention (DLP) and enterprise data protection, with experience progressing from hands-on technical work into architecture and design.
• Experience defining data classification, tagging, cataloging, access, and governance standards.
• Strong understanding of data protection controls, including encryption, masking, tokenization, and identity/access controls.
• Understanding of Data Security Posture Management (DSPM) and its role within an enterprise data security architecture.
• Experience developing reusable security patterns, reference architectures, and standards for engineering implementation.
• Ability to connect data security, identity, governance, and platform security controls.
• Strong communication and stakeholder-management skills, including the ability to explain technical security risks in business terms.
• Ability to collaborate with engineering teams and guide implementation without necessarily performing all tool configuration or administration.
• Must be located within reasonable commuting distance of Westbrook, Maine, or elsewhere in New England with the ability to travel to Westbrook for onsite visits a few times per month.

5. Mandatory SkillsA. Data Security Architecture

• Enterprise data security architecture and design
• Security standards, reference architectures, and reusable protection patterns
• Integration of data, identity, platform, and security controls

B. DLP and Enterprise Data Protection

• Data Loss Prevention (DLP)
• Enterprise data protection principles and controls
• Experience translating hands-on data protection knowledge into architecture and design

C. Data Classification and Governance

• Data classification and tagging
• Data cataloging and governance standards
• Sensitive-data access and protection requirements

D. Data Protection Controls

• Encryption
• Data masking
• Tokenization
• Identity and access controls
• Ability to select appropriate controls based on data sensitivity and risk

E. DSPM

• Understanding of Data Security Posture Management
• Ability to integrate DSPM capabilities into broader data security architecture

F. Architecture Communication and Influence

• Development of architecture standards and implementation guidance
• Collaboration with engineering and business stakeholders
• Ability to communicate security risks and architectural recommendations clearly

6. Preferred Skills

• Snowflake security and governance
• Zscaler DLP
• DSPM platforms
• Alation or similar data governance and cataloging platforms
• Cloud Access Security Broker (CASB)
• AWS, Azure, and/or GCP security
• Identity and Access Management (IAM)
• AI governance
• Enterprise data governance

Note: Specific product expertise is beneficial but not the primary selection criterion. Clint prioritizes candidates who can architect how data, identity, governance, and security controls work together over candidates whose experience is limited to administering individual tools.

7. Technical Environment

• Data Loss Prevention (DLP) / Zscaler
• Data Security Posture Management (DSPM)
• Snowflake
• Alation
• CASB
• Data classification, tagging, and cataloging
• Encryption, tokenization, and masking
• Identity and access controls
• Cloud security
• AI governance and data governance

Pay: $70.00 - $80.00 per hour

Work Location: Remote