Cloud Platform Security Architect

Cloud Platform Security Architect Remote 3 month contract remote possible extension About the role The client needs the access model that would let a Databricks workspace profile data across their AWS accounts — from a governance standpoint, not a business one. A scanning identity with broad read access across a regulated estate attracts real scrutiny, and security approval lead times can exceed the length of this engagement. You exist to get that answer early, and in a form the client’s information security function will accept. You also own the single question that most shapes the recommendation: how much of the in-scope S3 estate is registered in the AWS Glue Data Catalog. Collibra’s S3 profiling depends on it, so that number largely decides the target-state option. Nobody currently knows it. What you will do Establish AWS Glue Data Catalog coverage across the in-scope accounts and buckets, and quantify the gap. This is the first deliverable and it gates the option recommendation. Document how the incumbent product authenticates and reaches data today — cross-account roles, network paths, endpoints — as the baseline for any replacement. Design the least-privilege cross-account access model for a Databricks-based scanning workload: IAM roles and trust policies, S3 bucket policies, and cross-account KMS key policies. Design network access — VPC endpoints, PrivateLink, and serverless networking configuration as applicable. Produce security-review-ready documentation: data flows, trust boundaries, identities, permission scopes, data classification per flow, and compensating controls. Assume a formal threat model is required. Secure the information security review slot in week 1 rather than week 9, and steer the design through to approval. Identify a pre-approved non-production account and dataset in which the prototype can legitimately run. Author the security and governance model deliverable, and the operating model for running the scanning workload in production.