Data Security Sr. Analyst

POSITION SUMMARY:

Targa is seeking a hands-on Data Security Sr. Analyst to own the security and access model for the enterprise data and analytics platform. This role decides who can see and use which data, puts those decisions into enforced controls, and makes sure the platform stays compliant as more people, more data sources, and more AI use it.

This Sr. Analyst owns data security policy and Microsoft Purview governance for the platform — classification, sensitivity labels, access policies, and audit — across Microsoft Fabric and Databricks, working with the Platform / Fabric Administrator, who runs Purview day to day, and with enterprise cybersecurity. The scope covers enterprise, OT, and third-party data, including privacy-sensitive HR and financial data. As AI assistants and agents can find and combine data faster than any person, this role is central to using AI safely: making sure every person, assistant, and agent sees only what it should, and that Targa can prove it.

JOB FUNCTIONS AND KEY RESPONSIBILITIES:

• Design and maintain the data access model across workspaces, data products, and layers, based on roles and least privilege.

• Define row-level, object-level, and column-level security patterns for sensitive data across Microsoft Fabric, Power BI, and Databricks (Unity Catalog).

• Own access requests, approvals, and periodic access reviews for the data platform, moving from manual, workspace-by-workspace access toward automated, policy-based access at scale.

• Govern identities and credentials for non-human access, including service principals, managed identities, gateway credentials, and secrets in Azure Key Vault, with defined scope, rotation, and audit.

• Define the data classification scheme and sensitivity labels and how they are applied; use AI-assisted, policy-based classification to label data at scale, setting the rules and validating the results.

• Set access policies and data loss prevention controls in Purview, implemented with the Platform / Fabric Administrator.

• Define encryption, key management, and network isolation standards for the data platform, including encryption at rest and in transit, private endpoints, and Fabric private links.

• Refine and expand the guardrails that let citizen developers find and use data safely.

• Define how Copilot, AI assistants, and AI agents are allowed to access data; ensure permissions and labels are accurate enough that AI does not overshare sensitive data.

• Define identity, scope, and audit trail requirements for AI agents acting on behalf of people or on their own.

• Implement AI-specific data security controls, such as Purview Data Security Posture Management for AI, to monitor what data flows into prompts and responses.

• Secure OT data flows from the industrial network into the platform, partnering with the Data Ingestion Lead (Enterprise & OT) and OT cybersecurity on IT/OT boundaries, approved connectivity, and data diodes or brokers; work with the owners of TSA pipeline security directive compliance on how OT data leaves the control network.

• Own security of inbound third-party data from customers, suppliers, and data providers, and of outbound data sharing and external guest access, including the data-sharing and contract terms that govern both.

• Define handling standards for privacy-sensitive data, including PII, employee, and payroll data from systems such as UKG and financial data from Oracle, and ensure compliance with applicable privacy requirements.

• Own data platform controls that support SOX and other compliance requirements, including evidence for audits.

• Support retention, legal hold, and eDiscovery requirements for platform data with Legal and Records Management.

• Monitor access and activity for unusual or risky behavior using AI-based detection, and own the data-exposure incident playbook, coordinating response with the cybersecurity team.

• Write and maintain data security standards and procedures for the platform.

• Work with enterprise cybersecurity and identity teams on identity, threat, and incident response.

• Guide Data Management and Data Solutions on secure design for pipelines, data products, and semantic models.

• Work with data owners to classify data and approve access appropriately.

• Establish and report metrics for share of platform data classified and labeled, access reviews completed on schedule with no material audit findings, access requests handled within agreed time and policy, data security incidents and oversharing exposures identified and closed, and oversharing risks remediated before Copilot or agent rollout to each data domain.

• Other duties as assigned.